Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
37O0XUq6Vp.exe

Overview

General Information

Sample name:37O0XUq6Vp.exe
renamed because original name is a hash value
Original sample name:6a8b4f2e6f6398028985b35daed7f8ecaabc96e3b6c9473c26277b353a0baba6.exe
Analysis ID:1576977
MD5:262c88e2e99892879212fadae43c050e
SHA1:da4eb98c1fd353c8783a0217c07f2f69975e2919
SHA256:6a8b4f2e6f6398028985b35daed7f8ecaabc96e3b6c9473c26277b353a0baba6
Tags:104-161-43-18Compilazioneprotetticopyrightexeuser-JAMESWT_MHT
Infos:

Detection

RHADAMANTHYS
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected RHADAMANTHYS Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Drops PE files to the document folder of the user
Drops large PE files
Injects a PE file into a foreign processes
Machine Learning detection for sample
Switches to a custom stack to bypass stack traces
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Drops PE files
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Installs a raw input device (often for capturing keystrokes)
Internet Provider seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
One or more processes crash
PE file contains an invalid checksum
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Uncommon Svchost Parent Process
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Keylogger Generic

Classification

  • System is w10x64
  • 37O0XUq6Vp.exe (PID: 2436 cmdline: "C:\Users\user\Desktop\37O0XUq6Vp.exe" MD5: 262C88E2E99892879212FADAE43C050E)
    • 37O0XUq6Vp.exe (PID: 2468 cmdline: "C:\Users\user\Desktop\37O0XUq6Vp.exe" MD5: 262C88E2E99892879212FADAE43C050E)
      • svchost.exe (PID: 2228 cmdline: "C:\Windows\System32\svchost.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)
        • fontdrvhost.exe (PID: 1812 cmdline: "C:\Windows\System32\fontdrvhost.exe" MD5: BBCB897697B3442657C7D6E3EDDBD25F)
          • WerFault.exe (PID: 1096 cmdline: C:\Windows\system32\WerFault.exe -u -p 1812 -s 140 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
      • WerFault.exe (PID: 6132 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 452 MD5: C31336C1EFC2CCB44B4326EA793040F2)
  • cleanup
{"C2 url": "https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8"}
SourceRuleDescriptionAuthorStrings
00000004.00000003.2311812189.00000000031D0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RHADAMANTHYSYara detected RHADAMANTHYS StealerJoe Security
    00000003.00000003.2304302873.0000000000870000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RHADAMANTHYSYara detected RHADAMANTHYS StealerJoe Security
      00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
        00000003.00000002.2327001865.0000000000AB0000.00000040.00001000.00020000.00000000.sdmpJoeSecurity_RHADAMANTHYSYara detected RHADAMANTHYS StealerJoe Security
          00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmpJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
            Click to see the 5 entries
            SourceRuleDescriptionAuthorStrings
            4.3.svchost.exe.5580000.0.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
              4.3.svchost.exe.57a0000.7.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                4.3.svchost.exe.5580000.6.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                  3.3.37O0XUq6Vp.exe.2e80000.6.raw.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                    4.3.svchost.exe.5580000.6.unpackJoeSecurity_Keylogger_GenericYara detected Keylogger GenericJoe Security
                      Click to see the 1 entries

                      System Summary

                      barindex
                      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\37O0XUq6Vp.exe, ProcessId: 2436, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PerfectouinVans
                      Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\37O0XUq6Vp.exe", ParentImage: C:\Users\user\Desktop\37O0XUq6Vp.exe, ParentProcessId: 2468, ParentProcessName: 37O0XUq6Vp.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 2228, ProcessName: svchost.exe
                      Source: Process startedAuthor: vburov: Data: Command: "C:\Windows\System32\svchost.exe", CommandLine: "C:\Windows\System32\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\37O0XUq6Vp.exe", ParentImage: C:\Users\user\Desktop\37O0XUq6Vp.exe, ParentProcessId: 2468, ParentProcessName: 37O0XUq6Vp.exe, ProcessCommandLine: "C:\Windows\System32\svchost.exe", ProcessId: 2228, ProcessName: svchost.exe
                      TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                      2024-12-17T20:18:32.582894+010028548021Domain Observed Used for C2 Detected104.161.43.182845192.168.2.549741TCP

                      Click to jump to signature section

                      Show All Signature Results

                      AV Detection

                      barindex
                      Source: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpMalware Configuration Extractor: Rhadamanthys {"C2 url": "https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8"}
                      Source: 37O0XUq6Vp.exeReversingLabs: Detection: 57%
                      Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                      Source: 37O0XUq6Vp.exeJoe Sandbox ML: detected
                      Source: 37O0XUq6Vp.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: 37O0XUq6Vp.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                      Source: Binary string: wkernel32.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2308566205.0000000000FB0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308689104.0000000002F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313987370.00000000056A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313882941.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wkernelbase.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: .PDB$k@# source: svchost.exe, 00000004.00000002.2404303349.0000000003680000.00000040.00001000.00020000.00000000.sdmp
                      Source: Binary string: ntdll.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2307645313.0000000003070000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2307440563.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313232573.0000000005770000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313018966.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wntdll.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2308204606.0000000003020000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308005673.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313499201.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313677651.0000000005720000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: D:\winapps\gu6\exe\vc\DiskDefrag\sourcecode\Release_s\DiskDefrag.pdb`Il source: 37O0XUq6Vp.exe, PerfectouinVans.exe.0.dr
                      Source: Binary string: ntdll.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2307645313.0000000003070000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2307440563.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313232573.0000000005770000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313018966.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wntdll.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2308204606.0000000003020000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308005673.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313499201.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313677651.0000000005720000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wkernel32.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2308566205.0000000000FB0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308689104.0000000002F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313987370.00000000056A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313882941.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wkernelbase.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: D:\winapps\gu6\exe\vc\DiskDefrag\sourcecode\Release_s\DiskDefrag.pdb source: 37O0XUq6Vp.exe, PerfectouinVans.exe.0.dr
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0045A7D0 GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FindFirstFileW,FindClose,GetDiskFreeSpaceW,0_2_0045A7D0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00462F00 FindFirstFileW,FindClose,0_2_00462F00
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00411150 FindFirstFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,0_2_00411150
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004631F0 FindFirstFileW,FindNextFileW,FindClose,0_2_004631F0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00411150 FindFirstFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,3_2_00411150
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_0045A7D0 GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FindFirstFileW,FindClose,GetDiskFreeSpaceW,3_2_0045A7D0
                      Source: C:\Windows\System32\fontdrvhost.exeCode function: 4x nop then dec esp8_2_00000157FF9F0511

                      Networking

                      barindex
                      Source: Network trafficSuricata IDS: 2854802 - Severity 1 - ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert : 104.161.43.18:2845 -> 192.168.2.5:49741
                      Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 104.161.43.18 2845Jump to behavior
                      Source: Malware configuration extractorURLs: https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8
                      Source: global trafficTCP traffic: 192.168.2.5:49741 -> 104.161.43.18:2845
                      Source: Joe Sandbox ViewIP Address: 104.161.43.18 104.161.43.18
                      Source: Joe Sandbox ViewASN Name: IOFLOODUS IOFLOODUS
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: unknownTCP traffic detected without corresponding DNS query: 104.161.43.18
                      Source: 37O0XUq6Vp.exe, PerfectouinVans.exe.0.drString found in binary or memory: http://www.glarysoft.com/goto.php?a=upgradetopro&s=DiskDefrag340100134010023401003340100434010053401
                      Source: svchost.exe, 00000004.00000002.2401068267.0000000002DDC000.00000004.00000010.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2403644974.000000000350C000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, fontdrvhost.exe, 00000008.00000002.2495578577.00000157FF9F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8
                      Source: svchost.exe, 00000004.00000002.2403644974.000000000350C000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000008.00000002.2495578577.00000157FF9F0000.00000040.00000001.00020000.00000000.sdmpString found in binary or memory: https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8kernelbasentdllkernel32GetProcessMitigatio
                      Source: svchost.exe, 00000004.00000002.2401068267.0000000002DDC000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8x
                      Source: svchost.exe, 00000004.00000003.2331878893.00000000035A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cloudflare-dns.com/dns-query
                      Source: svchost.exe, 00000004.00000003.2331878893.00000000035A2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachi
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: DirectInput8Creatememstr_d0dc9939-2
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: GetRawInputDatamemstr_58cd544a-5
                      Source: Yara matchFile source: 4.3.svchost.exe.5580000.0.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.svchost.exe.57a0000.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.svchost.exe.5580000.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.37O0XUq6Vp.exe.2e80000.6.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 4.3.svchost.exe.5580000.6.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 3.3.37O0XUq6Vp.exe.30a0000.7.raw.unpack, type: UNPACKEDPE
                      Source: Yara matchFile source: 00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: Process Memory Space: 37O0XUq6Vp.exe PID: 2468, type: MEMORYSTR
                      Source: Yara matchFile source: Process Memory Space: svchost.exe PID: 2228, type: MEMORYSTR

                      System Summary

                      barindex
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeFile dump: PerfectouinVans.exe.0.dr 979567347Jump to dropped file
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044839D NtQueryDefaultLocale,0_2_0044839D
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004480FF NtQueryDefaultLocale,0_2_004480FF
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00448155 NtQueryDefaultLocale,0_2_00448155
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447B7F NtQueryDefaultLocale,0_2_00447B7F
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447C22 NtQueryDefaultLocale,0_2_00447C22
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447EC9 NtQueryDefaultLocale,0_2_00447EC9
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447F20 NtQueryDefaultLocale,0_2_00447F20
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447FCC NtQueryDefaultLocale,0_2_00447FCC
                      Source: C:\Windows\System32\fontdrvhost.exeCode function: 8_2_00000157FF9F0AC8 NtAcceptConnectPort,NtAcceptConnectPort,8_2_00000157FF9F0AC8
                      Source: C:\Windows\System32\fontdrvhost.exeCode function: 8_2_00000157FF9F15C0 NtAcceptConnectPort,8_2_00000157FF9F15C0
                      Source: C:\Windows\System32\fontdrvhost.exeCode function: 8_2_00000157FF9F1CF4 NtAcceptConnectPort,CloseHandle,8_2_00000157FF9F1CF4
                      Source: C:\Windows\System32\fontdrvhost.exeCode function: 8_2_00000157FF9F1AA4 NtAcceptConnectPort,NtAcceptConnectPort,8_2_00000157FF9F1AA4
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00460070: DeviceIoControl,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,0_2_00460070
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041E0F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_0041E0F0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044839D0_2_0044839D
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044F7360_2_0044F736
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043A01A0_2_0043A01A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043A14A0_2_0043A14A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004481550_2_00448155
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043A13E0_2_0043A13E
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004361840_2_00436184
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044A1940_2_0044A194
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043A2580_2_0043A258
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004362620_2_00436262
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044C3480_2_0044C348
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004403570_2_00440357
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0045036D0_2_0045036D
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004383980_2_00438398
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004363B20_2_004363B2
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044C4500_2_0044C450
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043645C0_2_0043645C
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043646B0_2_0043646B
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044C4020_2_0044C402
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044242E0_2_0044242E
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004424330_2_00442433
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004505040_2_00450504
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044267B0_2_0044267B
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004406A80_2_004406A8
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044277A0_2_0044277A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044A7200_2_0044A720
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043472C0_2_0043472C
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004347D70_2_004347D7
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004348940_2_00434894
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044E9060_2_0044E906
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00438A570_2_00438A57
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00442A530_2_00442A53
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00440A740_2_00440A74
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00450A8F0_2_00450A8F
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044EA8A0_2_0044EA8A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044CA8B0_2_0044CA8B
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00444B6E0_2_00444B6E
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044CB740_2_0044CB74
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00436BE40_2_00436BE4
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043ACE30_2_0043ACE3
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044CD110_2_0044CD11
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043ADC00_2_0043ADC0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00438E7B0_2_00438E7B
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044CE180_2_0044CE18
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00448EA80_2_00448EA8
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00468F800_2_00468F80
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044EF8A0_2_0044EF8A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00448F990_2_00448F99
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044504F0_2_0044504F
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004450080_2_00445008
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043D0200_2_0043D020
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044D0990_2_0044D099
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044F17C0_2_0044F17C
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044B13A0_2_0044B13A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004491DB0_2_004491DB
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044519F0_2_0044519F
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004452640_2_00445264
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044D2E80_2_0044D2E8
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004452A30_2_004452A3
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004452B30_2_004452B3
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004453140_2_00445314
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004453960_2_00445396
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004394A50_2_004394A5
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004475600_2_00447560
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043D5250_2_0043D525
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044D52C0_2_0044D52C
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004475D10_2_004475D1
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043F5810_2_0043F581
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004495990_2_00449599
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004355A30_2_004355A3
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004496260_2_00449626
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004476F00_2_004476F0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004457600_2_00445760
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043F7250_2_0043F725
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004377DB0_2_004377DB
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004398500_2_00439850
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043D86A0_2_0043D86A
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043F8DD0_2_0043F8DD
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004579F00_2_004579F0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041FAB00_2_0041FAB0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447B7F0_2_00447B7F
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043FB050_2_0043FB05
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043FC660_2_0043FC66
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043FC320_2_0043FC32
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0043FD210_2_0043FD21
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00439D990_2_00439D99
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0050DE5C0_2_0050DE5C
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447EC90_2_00447EC9
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0044FEF90_2_0044FEF9
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00439F680_2_00439F68
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00439F6E0_2_00439F6E
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00461F100_2_00461F10
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00447FCC0_2_00447FCC
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00439FFC0_2_00439FFC
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_006081D23_3_006081D2
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_005FC2313_3_005FC231
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_005FC4003_3_005FC400
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_004390C53_2_004390C5
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_004355A33_2_004355A3
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00438A573_2_00438A57
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_004377DB3_2_004377DB
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00468F803_2_00468F80
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_004383983_2_00438398
                      Source: C:\Windows\System32\fontdrvhost.exeCode function: 8_2_00000157FF9F0C708_2_00000157FF9F0C70
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: String function: 00474096 appears 238 times
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: String function: 005FCD90 appears 33 times
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: String function: 0040AC20 appears 40 times
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: String function: 0040AB60 appears 34 times
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 452
                      Source: 37O0XUq6Vp.exeBinary or memory string: OriginalFilename vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2370284789.00000000022F9000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCFF Explorer.exe: vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDiskDefrag.exe@ vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameCFF Explorer.exe: vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000000.00000000.2131037382.0000000000499000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDiskDefrag.exe@ vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2370477862.0000000002390000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameDiskDefrag.exe@ vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000000.2292118983.0000000000499000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameDiskDefrag.exe@ vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2308566205.0000000000FB0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2308689104.0000000002F00000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2308005673.0000000002FA3000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.0000000003281000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenameKernelbase.dllj% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2308204606.000000000314D000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2307440563.0000000002FF8000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2307645313.00000000031F6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2305932136.0000000000619000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCFF Explorer.exe: vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2308689104.0000000002F50000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2311734095.0000000000619000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: OriginalFilenameCFF Explorer.exe: vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2308566205.0000000001042000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamekernel32j% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exe, 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenameKernelbase.dllj% vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exeBinary or memory string: OriginalFilenameDiskDefrag.exe@ vs 37O0XUq6Vp.exe
                      Source: 37O0XUq6Vp.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2370284789.00000000022F9000.00000040.00001000.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2305932136.0000000000619000.00000040.00000400.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2311734095.0000000000619000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
                      Source: 37O0XUq6Vp.exe, 37O0XUq6Vp.exe, 00000000.00000002.2370284789.00000000022F9000.00000040.00001000.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2305932136.0000000000619000.00000040.00000400.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2311734095.0000000000619000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_
                      Source: classification engineClassification label: mal100.troj.evad.winEXE@9/6@0/1
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041E0F0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,0_2_0041E0F0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00419CF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,0_2_00419CF0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00419D90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,CloseHandle,AdjustTokenPrivileges,CloseHandle,CloseHandle,0_2_00419D90
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00419CF0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,GetLastError,3_2_00419CF0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0045A7D0 GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FindFirstFileW,FindClose,GetDiskFreeSpaceW,0_2_0045A7D0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00452A13 CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,0_2_00452A13
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041B4B0 OpenSCManagerW,OpenServiceW,CloseServiceHandle,QueryServiceStatus,QueryServiceStatus,ControlService,QueryServiceStatus,Sleep,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceW,QueryServiceStatus,Sleep,Sleep,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_0041B4B0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeFile created: C:\Users\user\Documents\PerfectouinJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeMutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-d4daedc7-d45f-905ab4-2729bc7b69fc}
                      Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1812
                      Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\85329e15-1428-428c-a6fb-183f60f8f5e2Jump to behavior
                      Source: 37O0XUq6Vp.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                      Source: C:\Windows\SysWOW64\svchost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\SysWOW64\svchost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                      Source: 37O0XUq6Vp.exeReversingLabs: Detection: 57%
                      Source: 37O0XUq6Vp.exeString found in binary or memory: -InstallNative
                      Source: 37O0XUq6Vp.exeString found in binary or memory: -InstallNative
                      Source: 37O0XUq6Vp.exeString found in binary or memory: H{4391F12D-936B-4037-9383-DCB800DF7B65}chs-NewInstallNative-UninstallNative-InstallNativeSeBackupPrivilegeSeRestorePrivilegeText_ColorSelect_ColorFoucs_ColorFrame_Color-BootTimeDefrag{E0A52416-D56A-4c3d-BFC7-3F40E77C718E}SYSTEM\CurrentControlSet\services\BootDefrag\DiskDefrag%SystemRoot%chbStartAutomaticallyOnLogonDiskDefrag\Setting Option\GereralDisk Speedup\DiskDefrag.exeDisk Speedup Initialization-autorunMinimizeToTrayShowBalloonchbMultithreadingchbStopVssDefragNTFSVSSColorIndexDiskDefrag\Setting Option\Gereral\DefragColorchbFrageMentsSmallerDiskDefrag\Setting Option\DefragcbbFrageMentsSmallerchbFileFragementAmountcbbFileFragementAmountchbFileLargercbbFileLargerchbFileSmallercbbFileSmallerCleanupTipCleanupTypeCheckDefragCPUIdleDiskDefrag\AutoDefragmentionCPUIdleTimeCheckPauseCPUUsageCPUUsageExceedAutoDefragDrivers1DefragmentedFilesLastDefragmentionCheckRunScheduleDiskDefrag\RunSheduleSheduleActionFrequencyWeekDayDayHourSheuldeDrivers\%d3400002ScheduleStartchbMoveLargeFilesDiskDefrag\Setting Option\OptimizechbMimiFileSizecbbFileSizechbNotAccesInLastchbFileInRecylechbFileInSelectedDiskDefrag\Setting Option\Optimize\OptimizeList3403001*.zip, *.rar3403002*.avi,*.mpg,*.mpeg,*.mov,*.mkv,*.mp3,*.mp4,*.wmv3403003*.iso,*.binDiskDefrag\Setting Option\ExcludeDefragFinishRingtone3402075DiskDefrag\SSDchbStopDefragInBatterySeShutdownPrivilegePowrProf.dllSetSuspendStatempegvideo%s/n
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeFile read: C:\Users\user\Desktop\37O0XUq6Vp.exeJump to behavior
                      Source: unknownProcess created: C:\Users\user\Desktop\37O0XUq6Vp.exe "C:\Users\user\Desktop\37O0XUq6Vp.exe"
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Users\user\Desktop\37O0XUq6Vp.exe "C:\Users\user\Desktop\37O0XUq6Vp.exe"
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 452
                      Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"
                      Source: C:\Windows\System32\fontdrvhost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 1812 -s 140
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Users\user\Desktop\37O0XUq6Vp.exe "C:\Users\user\Desktop\37O0XUq6Vp.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"Jump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: apphelp.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: msimg32.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: winmm.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: k7rn7l32.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: ntd3ll.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: amsi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: userenv.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: profapi.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: version.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: uxtheme.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: windows.storage.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wldp.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: sspicli.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: mpr.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: powrprof.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: umpdc.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: wbemcomn.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeSection loaded: mswsock.dllJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32Jump to behavior
                      Source: 37O0XUq6Vp.exeStatic file information: File size 1861632 > 1048576
                      Source: 37O0XUq6Vp.exeStatic PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x130400
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
                      Source: 37O0XUq6Vp.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                      Source: 37O0XUq6Vp.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                      Source: Binary string: wkernel32.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2308566205.0000000000FB0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308689104.0000000002F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313987370.00000000056A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313882941.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wkernelbase.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: .PDB$k@# source: svchost.exe, 00000004.00000002.2404303349.0000000003680000.00000040.00001000.00020000.00000000.sdmp
                      Source: Binary string: ntdll.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2307645313.0000000003070000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2307440563.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313232573.0000000005770000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313018966.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wntdll.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2308204606.0000000003020000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308005673.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313499201.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313677651.0000000005720000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: D:\winapps\gu6\exe\vc\DiskDefrag\sourcecode\Release_s\DiskDefrag.pdb`Il source: 37O0XUq6Vp.exe, PerfectouinVans.exe.0.dr
                      Source: Binary string: ntdll.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2307645313.0000000003070000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2307440563.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313232573.0000000005770000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313018966.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wntdll.pdb source: 37O0XUq6Vp.exe, 00000003.00000003.2308204606.0000000003020000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308005673.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313499201.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313677651.0000000005720000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wkernel32.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2308566205.0000000000FB0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2308689104.0000000002F00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313987370.00000000056A0000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2313882941.0000000005580000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: wkernelbase.pdbUGP source: 37O0XUq6Vp.exe, 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmp
                      Source: Binary string: D:\winapps\gu6\exe\vc\DiskDefrag\sourcecode\Release_s\DiskDefrag.pdb source: 37O0XUq6Vp.exe, PerfectouinVans.exe.0.dr
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041E180 LoadLibraryW,GetProcAddress,FreeLibrary,0_2_0041E180
                      Source: 37O0XUq6Vp.exeStatic PE information: real checksum: 0xf661c should be: 0x1ca26e
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0050E58E push ecx; ret 0_2_0050E5A1
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00473991 push ecx; ret 0_2_004739A4
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060B86D push ebx; ret 3_3_0060B864
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060A840 push ebp; retf 3_3_0060A841
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060E83C pushad ; ret 3_3_0060E841
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060E80E push eax; iretd 3_3_0060E81D
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060A0F9 push FFFFFF82h; iretd 3_3_0060A0FB
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060D8A0 push 0000002Eh; iretd 3_3_0060D8A2
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_00608904 push ecx; ret 3_3_00608917
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060B1DD push eax; ret 3_3_0060B1DF
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060E586 pushad ; retf 3_3_0060E599
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_00609F6A push eax; ret 3_3_00609F75
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_0060B70B push ebx; ret 3_3_0060B864
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_0043E840 push cs; retf 3_2_0043E8EC
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_004400D0 push cs; retf 3_2_004400D4
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00473991 push ecx; ret 3_2_004739A4
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_0043C660 push cs; retf 3_2_0043C672
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00447660 push cs; retf 3_2_00447666
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00445200 push cs; retf 3_2_00445225
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00447AA0 push cs; retf 3_2_00447AF8
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03015F0C push es; iretd 4_3_03015F0D
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03014920 push 0000002Eh; iretd 4_3_03014922
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03011179 push FFFFFF82h; iretd 4_3_0301117B
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_0301278B push ebx; ret 4_3_030128E4
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03010FEA push eax; ret 4_3_03010FF5
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03015FEE push FFFFFFD2h; retf 4_3_03016011
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03015606 pushad ; retf 4_3_03015619
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03016012 push 00000038h; iretd 4_3_0301601D
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_0301225D push eax; ret 4_3_0301225F
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_0301588E push eax; iretd 4_3_0301589D
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_030158BC pushad ; ret 4_3_030158C1

                      Persistence and Installation Behavior

                      barindex
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeFile created: C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exeJump to dropped file
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeFile created: C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exeJump to dropped file
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00411150 FindFirstFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,0_2_00411150
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004112B7 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,0_2_004112B7
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004112B9 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,0_2_004112B9
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00411150 FindFirstFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,3_2_00411150
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041B4B0 OpenSCManagerW,OpenServiceW,CloseServiceHandle,QueryServiceStatus,QueryServiceStatus,ControlService,QueryServiceStatus,Sleep,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,StartServiceW,QueryServiceStatus,Sleep,Sleep,QueryServiceStatus,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,0_2_0041B4B0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PerfectouinVansJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run PerfectouinVansJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00420B40 IsIconic,0_2_00420B40
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041F8D0 IsIconic,SendMessageW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,0_2_0041F8D0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                      Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                      Malware Analysis System Evasion

                      barindex
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeAPI/Special instruction interceptor: Address: 7FF8C88ED044
                      Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 7FF8C88ED044
                      Source: C:\Windows\SysWOW64\svchost.exeAPI/Special instruction interceptor: Address: 5ADB83A
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2370284789.00000000022F9000.00000040.00001000.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2305932136.0000000000619000.00000040.00000400.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2311734095.0000000000619000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
                      Source: 37O0XUq6Vp.exeBinary or memory string: CFF EXPLORER.EXE
                      Source: 37O0XUq6Vp.exe, 00000000.00000002.2370284789.00000000022F9000.00000040.00001000.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2305932136.0000000000619000.00000040.00000400.00020000.00000000.sdmp, 37O0XUq6Vp.exe, 00000003.00000003.2311734095.0000000000619000.00000040.00000400.00020000.00000000.sdmpBinary or memory string: INTERNALNAMECFF EXPLORER.EXE
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeDropped PE file which has not been started: C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exeJump to dropped file
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeAPI coverage: 0.3 %
                      Source: C:\Windows\SysWOW64\svchost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
                      Source: C:\Windows\SysWOW64\svchost.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0045A7D0 GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FindFirstFileW,FindClose,GetDiskFreeSpaceW,0_2_0045A7D0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00462F00 FindFirstFileW,FindClose,0_2_00462F00
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00411150 FindFirstFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,0_2_00411150
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004631F0 FindFirstFileW,FindNextFileW,FindClose,0_2_004631F0
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_00411150 FindFirstFileW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,StrFormatByteSizeW,GetPrivateProfileStringW,FindNextFileW,FindClose,3_2_00411150
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_0045A7D0 GetDiskFreeSpaceExW,GetDiskFreeSpaceW,FindFirstFileW,FindClose,GetDiskFreeSpaceW,3_2_0045A7D0
                      Source: svchost.exe, 00000004.00000002.2403385534.000000000345C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: MSAFD L2CAP [Bluetooth]Hyper-V RAW
                      Source: svchost.exe, 00000004.00000002.2404303349.0000000003680000.00000040.00001000.00020000.00000000.sdmpBinary or memory string: HGfs(
                      Source: svchost.exe, 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: DisableGuestVmNetworkConnectivity
                      Source: svchost.exe, 00000004.00000002.2402792630.0000000003400000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                      Source: svchost.exe, 00000004.00000002.2403041310.0000000003412000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW(
                      Source: svchost.exe, 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: EnableGuestVmNetworkConnectivity
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess information queried: ProcessInformationJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_00609098 VirtualAlloc,LdrInitializeThunk,VirtualFree,3_3_00609098
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004734E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_004734E6
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_0041E180 LoadLibraryW,GetProcAddress,FreeLibrary,0_2_0041E180
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_3_00609277 mov eax, dword ptr fs:[00000030h]3_3_00609277
                      Source: C:\Windows\SysWOW64\svchost.exeCode function: 4_3_03010283 mov eax, dword ptr fs:[00000030h]4_3_03010283
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00474040 GetProcessHeap,HeapFree,0_2_00474040
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Users\user\Desktop\37O0XUq6Vp.exe "C:\Users\user\Desktop\37O0XUq6Vp.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_004734E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,0_2_004734E6
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 3_2_004734E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_004734E6

                      HIPS / PFW / Operating System Protection Evasion

                      barindex
                      Source: C:\Windows\SysWOW64\svchost.exeNetwork Connect: 104.161.43.18 2845Jump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeMemory written: C:\Users\user\Desktop\37O0XUq6Vp.exe base: 5D0000 value starts with: 4D5AJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeProcess created: C:\Windows\SysWOW64\svchost.exe "C:\Windows\System32\svchost.exe"Jump to behavior
                      Source: C:\Windows\SysWOW64\svchost.exeProcess created: C:\Windows\System32\fontdrvhost.exe "C:\Windows\System32\fontdrvhost.exe"Jump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00502A5F cpuid 0_2_00502A5F
                      Source: C:\Windows\SysWOW64\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00441AA7 GetSystemTimeAsFileTime,FileTimeToSystemTime,FileTimeToSystemTime,GetTickCount,FileTimeToSystemTime,0_2_00441AA7
                      Source: C:\Users\user\Desktop\37O0XUq6Vp.exeCode function: 0_2_00419FF0 GetVersion,EnumWindows,IsWindow,SetForegroundWindow,SendMessageW,SendMessageW,SendMessageW,InitCommonControlsEx,CreateSolidBrush,EnumWindows,IsWindow,SetForegroundWindow,EnumWindows,IsWindow,SendMessageW,0_2_00419FF0
                      Source: C:\Windows\SysWOW64\svchost.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                      Stealing of Sensitive Information

                      barindex
                      Source: Yara matchFile source: 00000004.00000003.2311812189.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.2304302873.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2327001865.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.2404303349.0000000003680000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

                      Remote Access Functionality

                      barindex
                      Source: Yara matchFile source: 00000004.00000003.2311812189.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000003.2304302873.0000000000870000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000003.00000002.2327001865.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      Source: Yara matchFile source: 00000004.00000002.2404303349.0000000003680000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
                      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                      Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
                      Windows Management Instrumentation
                      1
                      DLL Side-Loading
                      1
                      DLL Side-Loading
                      1
                      Disable or Modify Tools
                      21
                      Input Capture
                      1
                      System Time Discovery
                      Remote Services1
                      Archive Collected Data
                      1
                      Encrypted Channel
                      Exfiltration Over Other Network Medium1
                      System Shutdown/Reboot
                      CredentialsDomainsDefault Accounts1
                      Native API
                      1
                      Windows Service
                      1
                      Access Token Manipulation
                      1
                      Deobfuscate/Decode Files or Information
                      LSASS Memory1
                      File and Directory Discovery
                      Remote Desktop Protocol21
                      Input Capture
                      1
                      Non-Standard Port
                      Exfiltration Over BluetoothNetwork Denial of Service
                      Email AddressesDNS ServerDomain Accounts2
                      Command and Scripting Interpreter
                      1
                      Registry Run Keys / Startup Folder
                      1
                      Windows Service
                      3
                      Obfuscated Files or Information
                      Security Account Manager126
                      System Information Discovery
                      SMB/Windows Admin SharesData from Network Shared Drive1
                      Application Layer Protocol
                      Automated ExfiltrationData Encrypted for Impact
                      Employee NamesVirtual Private ServerLocal Accounts2
                      Service Execution
                      Login Hook211
                      Process Injection
                      1
                      DLL Side-Loading
                      NTDS231
                      Security Software Discovery
                      Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
                      Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
                      Registry Run Keys / Startup Folder
                      1
                      Masquerading
                      LSA Secrets1
                      Virtualization/Sandbox Evasion
                      SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                      Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                      Virtualization/Sandbox Evasion
                      Cached Domain Credentials1
                      Process Discovery
                      VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                      DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                      Access Token Manipulation
                      DCSync1
                      Application Window Discovery
                      Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                      Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job211
                      Process Injection
                      Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                      Hide Legend

                      Legend:

                      • Process
                      • Signature
                      • Created File
                      • DNS/IP Info
                      • Is Dropped
                      • Is Windows Process
                      • Number of created Registry Values
                      • Number of created Files
                      • Visual Basic
                      • Delphi
                      • Java
                      • .Net C# or VB.NET
                      • C, C++ or other language
                      • Is malicious
                      • Internet

                      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                      windows-stand
                      SourceDetectionScannerLabelLink
                      37O0XUq6Vp.exe58%ReversingLabs
                      37O0XUq6Vp.exe100%Joe Sandbox ML
                      No Antivirus matches
                      No Antivirus matches
                      No Antivirus matches
                      SourceDetectionScannerLabelLink
                      https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8kernelbasentdllkernel32GetProcessMitigatio0%Avira URL Cloudsafe
                      https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt80%Avira URL Cloudsafe
                      https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8x0%Avira URL Cloudsafe
                      No contacted domains info
                      NameMaliciousAntivirus DetectionReputation
                      https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8true
                      • Avira URL Cloud: safe
                      unknown
                      NameSourceMaliciousAntivirus DetectionReputation
                      https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8xsvchost.exe, 00000004.00000002.2401068267.0000000002DDC000.00000004.00000010.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: safe
                      unknown
                      https://cloudflare-dns.com/dns-querysvchost.exe, 00000004.00000003.2331878893.00000000035A2000.00000004.00000020.00020000.00000000.sdmpfalse
                        high
                        https://cloudflare-dns.com/dns-queryPOSTContent-TypeContent-LengthHostapplication/dns-message%dMachisvchost.exe, 00000004.00000003.2331878893.00000000035A2000.00000004.00000020.00020000.00000000.sdmpfalse
                          high
                          https://104.161.43.18:2845/7e56fc199c7194d0/vhj85b49.mnrt8kernelbasentdllkernel32GetProcessMitigatiosvchost.exe, 00000004.00000002.2403644974.000000000350C000.00000004.00000020.00020000.00000000.sdmp, fontdrvhost.exe, 00000008.00000002.2495578577.00000157FF9F0000.00000040.00000001.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          unknown
                          http://www.glarysoft.com/goto.php?a=upgradetopro&s=DiskDefrag34010013401002340100334010043401005340137O0XUq6Vp.exe, PerfectouinVans.exe.0.drfalse
                            high
                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs
                            IPDomainCountryFlagASNASN NameMalicious
                            104.161.43.18
                            unknownUnited States
                            53755IOFLOODUStrue
                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1576977
                            Start date and time:2024-12-17 20:17:08 +01:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 8m 56s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:12
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:37O0XUq6Vp.exe
                            renamed because original name is a hash value
                            Original Sample Name:6a8b4f2e6f6398028985b35daed7f8ecaabc96e3b6c9473c26277b353a0baba6.exe
                            Detection:MAL
                            Classification:mal100.troj.evad.winEXE@9/6@0/1
                            EGA Information:
                            • Successful, ratio: 50%
                            HCA Information:Failed
                            Cookbook Comments:
                            • Found application associated with file extension: .exe
                            • Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
                            • Excluded IPs from analysis (whitelisted): 20.189.173.22, 20.190.147.12, 13.107.246.63, 172.202.163.200, 23.1.237.91
                            • Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, ocsp.digicert.com, login.live.com, otelrules.azureedge.net, slscr.update.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
                            • Execution Graph export aborted for target 37O0XUq6Vp.exe, PID 2468 because there are no executed function
                            • Execution Graph export aborted for target svchost.exe, PID 2228 because there are no executed function
                            • Report size exceeded maximum capacity and may have missing disassembly code.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • VT rate limit hit for: 37O0XUq6Vp.exe
                            TimeTypeDescription
                            14:18:45API Interceptor1x Sleep call for process: WerFault.exe modified
                            20:18:33AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run PerfectouinVans C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exe
                            20:18:41AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run PerfectouinVans C:\Users\user\Documents\Perfectouin\Bin\PerfectouinVans.exe
                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            104.161.43.18122046760.batGet hashmaliciousRHADAMANTHYSBrowse
                              pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                  873406390.batGet hashmaliciousRHADAMANTHYSBrowse
                                    0J3fAc6cHO.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                      1H57mPm9jr.exeGet hashmaliciousRHADAMANTHYSBrowse
                                        l92fYljXWF.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                          taCCGTk8n1.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                            No context
                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            IOFLOODUS122046760.batGet hashmaliciousRHADAMANTHYSBrowse
                                            • 104.161.43.18
                                            pkqLAMAv96.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                            • 104.161.43.18
                                            IIC0XbKFjS.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                            • 104.161.43.18
                                            873406390.batGet hashmaliciousRHADAMANTHYSBrowse
                                            • 104.161.43.18
                                            0J3fAc6cHO.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                            • 104.161.43.18
                                            svhost.exeGet hashmaliciousQuasarBrowse
                                            • 148.163.102.170
                                            KjECqzXLWp.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                            • 162.213.210.250
                                            cey4VIyGKh.lnkGet hashmaliciousRHADAMANTHYSBrowse
                                            • 162.213.210.250
                                            msimg32.dllGet hashmaliciousRHADAMANTHYSBrowse
                                            • 162.213.210.250
                                            msimg32.dllGet hashmaliciousRHADAMANTHYSBrowse
                                            • 162.213.210.250
                                            No context
                                            No context
                                            Process:C:\Windows\System32\WerFault.exe
                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.6603858783920593
                                            Encrypted:false
                                            SSDEEP:192:xhY4ZzHn6QxR0apYKjqzuiFt9Z24lO8JO:/Zrn10apYKjqzuiF/Y4lO8A
                                            MD5:3F7CD7272C37FC7FE0D9B3698C111916
                                            SHA1:F6AAA7C95549F0D314D06556DA3B8FF0F53A50AF
                                            SHA-256:2CC528705F27349F2BC72A8E531F2E35D70112FF7F9CC0D5A8C6AA37D0128314
                                            SHA-512:8946CB81A56C5EB810143C8169DA208B2B7C165EC61CFBB2D25F1DAA755AD29D092766C4D649F46A45304553B668EEFAF34D7B6CC4711714E5764DCE26BE7466
                                            Malicious:false
                                            Reputation:low
                                            Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.6.4.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.9.3.6.7.1.9.7.4.2.9.4.7.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.9.3.6.7.2.0.9.1.4.8.2.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.5.d.3.e.a.a.7.-.2.b.9.9.-.4.8.8.8.-.8.1.6.2.-.d.b.c.4.d.b.8.3.4.7.7.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.f.4.8.f.6.5.c.-.8.d.a.b.-.4.6.1.a.-.8.a.e.6.-.7.e.5.c.5.9.e.8.0.5.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.f.o.n.t.d.r.v.h.o.s.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.7.1.4.-.0.0.0.1.-.0.0.1.4.-.4.5.5.e.-.8.f.7.8.b.8.5.0.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.e.f.b.3.f.9.7.3.4.2.b.a.1.9.5.4.2.4.1.3.4.f.2.8.f.9.7.7.d.a.9.e.0.d.6.a.a.9.1.!.f.o.n.t.d.r.v.h.o.
                                            Process:C:\Windows\System32\WerFault.exe
                                            File Type:Mini DuMP crash report, 14 streams, Tue Dec 17 19:18:39 2024, 0x1205a4 type
                                            Category:dropped
                                            Size (bytes):46646
                                            Entropy (8bit):1.299568152017458
                                            Encrypted:false
                                            SSDEEP:96:5m8I627ysREZeyb/AFe7i7bHCAwQk3P5a3PlFWI5bIoTE:/iyxAWObHCXQNP4
                                            MD5:FDE50E649C04C86EA84FD9321F63ADD0
                                            SHA1:63D64E00C43592B11F4EBD168E9B820F4B6AD3F0
                                            SHA-256:F65B8200F33859069CCE8338E9E245C89C7D49DE51CE02FE2C3EE66F195E8078
                                            SHA-512:DE73991EBBBCA4B56FF37B9CC819D7176F5F2F5F0DF7B5B5E8ADB955607CBD45B05424AFDEF522AA0FED7CDFC01D95BE02931C83FC194DF152BA5289EAF2B3A0
                                            Malicious:false
                                            Reputation:low
                                            Preview:MDMP..a..... .........ag........................................2!..........T.......8...........T.......................................................................................................................eJ..............Lw......................T.............ag.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                            Process:C:\Windows\System32\WerFault.exe
                                            File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):8622
                                            Entropy (8bit):3.688625562296673
                                            Encrypted:false
                                            SSDEEP:192:R6l7wVeJAWoRjLUe6YDDAfCgmfr57v5pDa89b4FWfrrom:R6lXJZM6YnAfCgmfrFvv40ft
                                            MD5:C45D7ACCF26076FA7F6E226FA4474106
                                            SHA1:4F8943290E4E9C6F81A6D7442B15247B9A0A1360
                                            SHA-256:A57E97CF2A31A0AE2160F282507DDC2E16F4B7917D6A487955204C06A62F7C13
                                            SHA-512:B9647AFF41C9AC9C563257CDA13EEE65C981BEDD3450C0B8CD240ED10A26EEFA3F0EA7686B459162CDBD840657B46B9F22751D107A1E3D2FBB9A935BF5D74CCD
                                            Malicious:false
                                            Reputation:low
                                            Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.1.8.1.2.<./.P.i.
                                            Process:C:\Windows\System32\WerFault.exe
                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                            Category:dropped
                                            Size (bytes):4853
                                            Entropy (8bit):4.443957324749247
                                            Encrypted:false
                                            SSDEEP:48:cvIwWl8zsnJg771I9BuWpW8VYpYm8M4Jk5LvM6FR6dyq8vU5LvM74aMuJFd:uIjfJI72P7VdJcjMddWsjME1uDd
                                            MD5:70EE988E611E57426D56FA0C3FE97467
                                            SHA1:0D50F4972F8E37D0F16AACB23F3EC42C7380A146
                                            SHA-256:6B54E352D196623671C109EE412A09B49527AB7A5BAA1B54D1F8531B19A448E9
                                            SHA-512:390D5E5C55B6C70D8CE7EC7826E1BEF70B859203746BD58DEF36BD3FDB3C49BC86A472697209B38D7DEE83CE7B2114BBECAC86A2BCF3A6A7C6E0CCE90A1FD5D1
                                            Malicious:false
                                            Reputation:low
                                            Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="635661" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409
                                            Process:C:\Users\user\Desktop\37O0XUq6Vp.exe
                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                            Category:dropped
                                            Size (bytes):979567347
                                            Entropy (8bit):0.030789032428890344
                                            Encrypted:false
                                            SSDEEP:
                                            MD5:190DC71765ED6FC9E12EF1072C280B53
                                            SHA1:4F98518752FAA754CF0F21339ABBCAF0B9DC2334
                                            SHA-256:D9945E8AFA39D22C718980ADFC55992D25DF4629764724D8BC7B588290BBF701
                                            SHA-512:8F5F082AA0852548E6A498B20033A695986F22926B25B57662B309BDDF6B42399E31436213D87397AFD1930A2682E07A36FD257E73410F1F445D4113F675C9CB
                                            Malicious:true
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0..0..0......1......3......*....].3....^.=....H.%....O.?....X.'..0.......A......_.1....Z.1..Rich0..................PE..L......e.............................4............@..................................f....@..................................+..........0................S...p.........................................@...............p............................text............................... ..`.rdata..............................@..@.data....0...`.......H..............@....rsrc...0............d..............@..@........................................................................................................................................................................................................................................................................................................................................
                                            Process:C:\Windows\System32\WerFault.exe
                                            File Type:MS Windows registry file, NT/2000 or above
                                            Category:dropped
                                            Size (bytes):1835008
                                            Entropy (8bit):4.422410614894414
                                            Encrypted:false
                                            SSDEEP:6144:WSvfpi6ceLP/9skLmb0OTyWSPHaJG8nAgeMZMMhA2fX4WABlEnNU0uhiTw:1vloTyW+EZMM6DFym03w
                                            MD5:B82B26B3218A4682689F169116B2102B
                                            SHA1:4DAC203E44B5778593C134E6F433BF9AE6B2B575
                                            SHA-256:E4830EBB7A6C05F4D6DA1A80FC4921BD62A2BFBB45B48AEA7EF8944B0ED502DD
                                            SHA-512:A536CCAE04673ABB2C22BE65E0F681FF9E43BCFA4F6E7ABC7399D4D23209AE0531D16F24D3C3842AABBC7D53264405DFD4DEABC78CBB506FC5F07180F2DEA0BB
                                            Malicious:false
                                            Preview:regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm..zz.P...............................................................................................................................................................................................................................................................................................................................................VmN........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                            Entropy (8bit):7.1263466828904685
                                            TrID:
                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                            • DOS Executable Generic (2002/1) 0.02%
                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                            File name:37O0XUq6Vp.exe
                                            File size:1'861'632 bytes
                                            MD5:262c88e2e99892879212fadae43c050e
                                            SHA1:da4eb98c1fd353c8783a0217c07f2f69975e2919
                                            SHA256:6a8b4f2e6f6398028985b35daed7f8ecaabc96e3b6c9473c26277b353a0baba6
                                            SHA512:c552ac3fbcd167fb7e6f4b39df67e4633849e4131e5b19bba26ab791b40b6168bc78ec98625f0d6e9222713e17c563de6f326ebf2eea6866ed5f6cb5fb1ccf02
                                            SSDEEP:24576:0gr/qvg63jANRTeBnxslxdr8qOz7Qqg3OavsMf5dllLsXmJV/mFQPGqF2LJejp:0groT0evwGqM9gUCLLsX1eUMp
                                            TLSH:0A858E01BB4A803EC7211274E12263E11116B9FF975182D7E56A2C3FDB955E20F3BFA6
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0...0...0.......1.......3.......*.....].3.....^.=.....H.%.....O.?.....X.'...0.........A......._.1.....Z.1...Rich0..........
                                            Icon Hash:0f0371696969030e
                                            Entrypoint:0x4734dc
                                            Entrypoint Section:.text
                                            Digitally signed:true
                                            Imagebase:0x400000
                                            Subsystem:windows gui
                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                            Time Stamp:0x65EABAFA [Fri Mar 8 07:15:06 2024 UTC]
                                            TLS Callbacks:
                                            CLR (.Net) Version:
                                            OS Version Major:5
                                            OS Version Minor:0
                                            File Version Major:5
                                            File Version Minor:0
                                            Subsystem Version Major:5
                                            Subsystem Version Minor:0
                                            Import Hash:95c864c12aad39a0a38f3fd87dabadf6
                                            Signature Valid:
                                            Signature Issuer:
                                            Signature Validation Error:
                                            Error Number:
                                            Not Before, Not After
                                              Subject Chain
                                                Version:
                                                Thumbprint MD5:
                                                Thumbprint SHA-1:
                                                Thumbprint SHA-256:
                                                Serial:
                                                Instruction
                                                call 00007F207122C8DCh
                                                jmp 00007F207122C0FCh
                                                cmp ecx, dword ptr [00496028h]
                                                jne 00007F207122C3C4h
                                                rep ret
                                                jmp 00007F207122C95Eh
                                                int3
                                                jmp dword ptr [0047C31Ch]
                                                mov edi, edi
                                                push ebp
                                                mov ebp, esp
                                                test byte ptr [ebp+08h], 00000002h
                                                push edi
                                                mov edi, ecx
                                                je 00007F207122C3E7h
                                                push esi
                                                push 00473BC4h
                                                lea esi, dword ptr [edi-04h]
                                                push dword ptr [esi]
                                                push 0000000Ch
                                                push edi
                                                call 00007F207122C587h
                                                test byte ptr [ebp+08h], 00000001h
                                                je 00007F207122C3C9h
                                                push esi
                                                call 00007F207122B6E8h
                                                pop ecx
                                                mov eax, esi
                                                pop esi
                                                jmp 00007F207122C3D6h
                                                call 00007F207122CA55h
                                                test byte ptr [ebp+08h], 00000001h
                                                je 00007F207122C3C9h
                                                push edi
                                                call 00007F207122B6D1h
                                                pop ecx
                                                mov eax, edi
                                                pop edi
                                                pop ebp
                                                retn 0004h
                                                jmp dword ptr [0047C304h]
                                                push 00000014h
                                                push 0048BD98h
                                                call 00007F207122C7B7h
                                                push dword ptr [004988A0h]
                                                mov esi, dword ptr [0047C35Ch]
                                                call esi
                                                pop ecx
                                                mov dword ptr [ebp-1Ch], eax
                                                cmp eax, FFFFFFFFh
                                                jne 00007F207122C3CEh
                                                push dword ptr [ebp+08h]
                                                call dword ptr [0047C360h]
                                                pop ecx
                                                jmp 00007F207122C429h
                                                push 00000008h
                                                call 00007F207122C9E1h
                                                pop ecx
                                                and dword ptr [ebp-04h], 00000000h
                                                push dword ptr [004988A0h]
                                                call esi
                                                mov dword ptr [ebp-1Ch], eax
                                                push dword ptr [0049889Ch]
                                                call esi
                                                pop ecx
                                                pop ecx
                                                mov dword ptr [ebp-20h], eax
                                                lea eax, dword ptr [ebp-20h]
                                                Programming Language:
                                                • [C++] VS2005 build 50727
                                                • [ C ] VS2005 build 50727
                                                • [IMP] VS2005 build 50727
                                                • [ASM] VS2008 build 21022
                                                • [ C ] VS2008 build 21022
                                                • [C++] VS2008 build 21022
                                                • [IMP] VS2008 build 21022
                                                • [RES] VS2008 build 21022
                                                • [LNK] VS2008 build 21022
                                                NameVirtual AddressVirtual Size Is in Section
                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x92b840x1f4.rdata
                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x990000x130330.rsrc
                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                IMAGE_DIRECTORY_ENTRY_SECURITY0xe1a000x5398.rsrc
                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0xd70000xa0e0.rsrc
                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x7cef00x1c.rdata
                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x886b00x40.rdata
                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IAT0x7c0000xe70.rdata
                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                .text0x10000x7b0000x7a800858e894976b470cc78046ce51b544d85False0.4935885682397959data6.634410017415103IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                .rdata0x7c0000x1a0000x19c003b400efe65270b63067ac97b9ecd3b54False0.30643203883495146data4.618234948722544IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .data0x960000x30000x1c00d49f398adb436223c993c2cd85f5add0False0.2431640625data4.453447405966862IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .rsrc0x990000x1303300x130400e886ee4d5b062c8d772cbe59491f7fb7False0.5181334095110929data7.199133638839448IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                PNG0x999f00xb8aPNG image data, 15 x 15, 8-bit/color RGBA, non-interlacedChineseChina1.0037237643872714
                                                RT_BITMAP0x9a57c0x248Device independent bitmap graphic, 64 x 15 x 4, image size 480, 16 important colorsChineseChina0.1267123287671233
                                                RT_BITMAP0x9a7c40xe8Device independent bitmap graphic, 16 x 16 x 4, image size 128, 16 important colorsChineseChina0.4698275862068966
                                                RT_ICON0x9a8ac0x58caPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedChineseChina0.9969643642762869
                                                RT_ICON0xa01780x10828Device independent bitmap graphic, 128 x 256 x 32, image size 67584ChineseChina0.13680054418549628
                                                RT_ICON0xb09a00x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 38016ChineseChina0.27982446920327936
                                                RT_ICON0xb9e480x67e8Device independent bitmap graphic, 80 x 160 x 32, image size 26560ChineseChina0.267406015037594
                                                RT_ICON0xc06300x5488Device independent bitmap graphic, 72 x 144 x 32, image size 21600ChineseChina0.31497227356746765
                                                RT_ICON0xc5ab80x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16896ChineseChina0.26452527161076994
                                                RT_ICON0xc9ce00x3a48Device independent bitmap graphic, 60 x 120 x 32, image size 14880ChineseChina0.3460455764075067
                                                RT_ICON0xcd7280x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9600ChineseChina0.39066390041493776
                                                RT_ICON0xcfcd00x1a68Device independent bitmap graphic, 40 x 80 x 32, image size 6720ChineseChina0.392603550295858
                                                RT_ICON0xd17380x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4224ChineseChina0.4294090056285178
                                                RT_ICON0xd27e00x988Device independent bitmap graphic, 24 x 48 x 32, image size 2400ChineseChina0.5868852459016394
                                                RT_ICON0xd31680x6b8Device independent bitmap graphic, 20 x 40 x 32, image size 1680ChineseChina0.6319767441860465
                                                RT_ICON0xd38200x468Device independent bitmap graphic, 16 x 32 x 32, image size 1088ChineseChina0.6968085106382979
                                                RT_MENU0xd3c880x1e8Matlab v4 mat-file (little endian) D, numeric, rows 4587536, columns 7077993, imaginaryChineseChina0.4774590163934426
                                                RT_MENU0xd3e700x1e0Matlab v4 mat-file (little endian) S, numeric, rows 4980752, columns 5439561, imaginaryChineseChina0.4979166666666667
                                                RT_DIALOG0xd40500x1d8dataChineseChina0.5932203389830508
                                                RT_DIALOG0xd42280x70dataChineseChina0.7857142857142857
                                                RT_DIALOG0xd42980x34dataChineseChina0.8461538461538461
                                                RT_DIALOG0xd42cc0x304dataChineseChina0.46113989637305697
                                                RT_DIALOG0xd45d00x1a0dataChineseChina0.49038461538461536
                                                RT_DIALOG0xd47700x104dataChineseChina0.65
                                                RT_DIALOG0xd48740x3cadataChineseChina0.4402061855670103
                                                RT_DIALOG0xd4c400x472dataChineseChina0.36203866432337434
                                                RT_DIALOG0xd50b40x2aadataChineseChina0.4472140762463343
                                                RT_DIALOG0xd53600x1f8dataChineseChina0.46825396825396826
                                                RT_DIALOG0xd55580x328dataChineseChina0.42945544554455445
                                                RT_DIALOG0xd58800x32cdataChineseChina0.4630541871921182
                                                RT_DIALOG0xd5bac0x21cdataChineseChina0.5222222222222223
                                                RT_DIALOG0xd5dc80x120dataChineseChina0.5590277777777778
                                                RT_DIALOG0xd5ee80x1f0dataChineseChina0.5544354838709677
                                                RT_DIALOG0xd60d80x2fedataChineseChina0.46866840731070497
                                                RT_DIALOG0xd63d80x6cdataChineseChina0.7777777777777778
                                                RT_STRING0xd64440x48dataChineseChina0.6944444444444444
                                                RT_GROUP_ICON0xd648c0xbcdataChineseChina0.7074468085106383
                                                RT_VERSION0xd65480x30cdataChineseChina0.45256410256410257
                                                RT_DLGINCLUDE0xd68540x6dc36PC bitmap, Windows 3.x format, 56565 x 2 x 45, image size 450204, cbSize 449590, bits offset 540.6961342556551525
                                                RT_ANIICON0x14448c0xd4a7PC bitmap, Windows 3.x format, 7095 x 2 x 44, image size 54527, cbSize 54439, bits offset 540.4094858465438381
                                                RT_ANIICON0x1519340xa04dPC bitmap, Windows 3.x format, 5231 x 2 x 37, image size 41398, cbSize 41037, bits offset 540.3575310086019933
                                                RT_ANIICON0x15b9840xbb6cPC bitmap, Windows 3.x format, 6443 x 2 x 52, image size 48704, cbSize 47980, bits offset 540.35377240516882036
                                                RT_ANIICON0x1674f00x34a4ePC bitmap, Windows 3.x format, 27327 x 2 x 47, image size 215637, cbSize 215630, bits offset 540.47575940268051753
                                                RT_ANIICON0x19bf400x2d3daPC bitmap, Windows 3.x format, 23843 x 2 x 42, image size 185378, cbSize 185306, bits offset 540.49876420623185436
                                                None0x1c931c0x14dataChineseChina1.25
                                                DLLImport
                                                KERNEL32.dllGetModuleHandleW, GetProcAddress, lstrlenW, GetLastError, LoadLibraryW, SetLastError, MulDiv, GetPrivateProfileStringW, GetVolumeInformationW, ExpandEnvironmentStringsW, FindFirstFileW, FindNextFileW, FindClose, InterlockedDecrement, CloseHandle, GetModuleFileNameW, InterlockedExchange, QueryPerformanceFrequency, QueryPerformanceCounter, GetCurrentProcess, CreateMutexW, Sleep, GetSystemTimeAsFileTime, GetLogicalDrives, GetDriveTypeW, GetLongPathNameW, GetVersion, GetVolumeNameForVolumeMountPointW, GetTickCount, WideCharToMultiByte, SetPriorityClass, GetPriorityClass, GetSystemPowerStatus, LeaveCriticalSection, FreeLibrary, GetCurrentThreadId, InitializeCriticalSection, DeleteCriticalSection, CreateThread, WaitForMultipleObjects, CreateFileW, DeviceIoControl, HeapFree, GetProcessHeap, GetCommandLineW, LocalFree, MultiByteToWideChar, GetComputerNameW, GetDiskFreeSpaceW, GetFileAttributesW, FileTimeToSystemTime, IsDebuggerPresent, UnhandledExceptionFilter, TerminateProcess, GetCurrentProcessId, EnterCriticalSection, SetUnhandledExceptionFilter, GetStartupInfoW, InterlockedCompareExchange, lstrlenA, LocalFileTimeToFileTime, DosDateTimeToFileTime, ReadFile, FormatMessageW, GetDiskFreeSpaceExW, FlushFileBuffers
                                                USER32.dllSetRectEmpty, EnableWindow, LoadBitmapW, GetDC, DrawTextW, ReleaseDC, CopyRect, DestroyCursor, SetCapture, GetCapture, EndDeferWindowPos, DeferWindowPos, BeginDeferWindowPos, ReleaseCapture, InsertMenuW, CreateMenu, GetWindowLongW, GetMenuItemInfoW, UnionRect, GetMenuBarInfo, EnableMenuItem, ModifyMenuW, GetMenuState, LoadImageW, GetSysColorBrush, SetWindowLongW, OffsetRect, SendNotifyMessageW, AppendMenuW, CreatePopupMenu, GetActiveWindow, MessageBoxW, TranslateMessage, PeekMessageW, MsgWaitForMultipleObjects, DispatchMessageW, GetSysColor, GetCursor, DrawIcon, LoadIconW, IsIconic, PostMessageW, KillTimer, SetTimer, LoadCursorW, SetCursor, GetSystemMetrics, GetSubMenu, CheckMenuItem, GetMenuItemID, GetMenuItemCount, LoadMenuW, GetLastInputInfo, ExitWindowsEx, SetPropW, SetForegroundWindow, EnumWindows, GetPropW, GetComboBoxInfo, InvalidateRect, InflateRect, GrayStringW, DrawTextExW, TabbedTextOutW, IsWindowVisible, IsWindow, ScreenToClient, GetCursorPos, RedrawWindow, PtInRect, TrackMouseEvent, GetParent, GetClientRect, SetRect, FrameRect, FillRect, GetWindowRect, SendMessageW
                                                GDI32.dllCreateSolidBrush, Escape, ExtTextOutW, PtVisible, CreatePen, GetDCBrushColor, GetBkMode, CreateRoundRectRgn, CreatePatternBrush, SetBrushOrgEx, FillRgn, FrameRgn, BeginPath, EndPath, FillPath, CreateFontIndirectW, Rectangle, GetDeviceCaps, PatBlt, RectVisible, GetBkColor, DPtoLP, GetMapMode, CreateCompatibleBitmap, LPtoDP, CreateFontW, GetTextMetricsW, TextOutW, GetTextExtentPoint32W, GetCurrentObject, GetDIBColorTable, StretchBlt, BitBlt, GetObjectW, SetDIBColorTable, SelectObject, CreateDIBSection, CreateCompatibleDC, DeleteDC, DeleteObject
                                                MSIMG32.dllAlphaBlend, TransparentBlt, GradientFill
                                                ADVAPI32.dllQueryServiceConfigW, GetUserNameW, RegCloseKey, OpenProcessToken, LookupPrivilegeValueW, ChangeServiceConfigW, RegSetValueExW, RegQueryValueExW, RegOpenKeyExW, StartServiceW, ControlService, QueryServiceStatus, CloseServiceHandle, OpenServiceW, OpenSCManagerW, RegOpenKeyW, AdjustTokenPrivileges
                                                SHELL32.dllSHGetFileInfoW, ShellExecuteW, SHGetSpecialFolderPathW, SHBrowseForFolderW, SHGetPathFromIDListW, Shell_NotifyIconW, SHQueryRecycleBinW, SHEmptyRecycleBinW, CommandLineToArgvW
                                                COMCTL32.dllInitCommonControlsEx, _TrackMouseEvent
                                                SHLWAPI.dllPathFileExistsW, StrFormatByteSizeW, ColorAdjustLuma, StrFormatKBSizeW
                                                ole32.dllCoSetProxyBlanket, CoUninitialize, CoInitialize, CoCreateInstance, CoTaskMemFree
                                                OLEAUT32.dllSysFreeString, VariantInit, VariantClear, SysAllocString
                                                gdiplus.dllGdipGetImageEncoders, GdipGetImageEncodersSize, GdipSaveImageToFile, GdipDeleteFont, GdipCreateFont, GdipDeleteFontFamily, GdipGetGenericFontFamilySansSerif, GdipCreateFontFamilyFromName, GdipDeleteCachedBitmap, GdipCreateCachedBitmap, GdipDrawCachedBitmap, GdipMeasureString, GdipDrawString, GdipFillPath, GdipFillPie, GdipFillEllipse, GdipFillRectangle, GdipDrawPath, GdipDrawPie, GdipDrawEllipse, GdipDrawRectangle, GdipDrawLine, GdipSetSmoothingMode, GdipCreateFromHDC, GdipAddPathPath, GdipAddPathArc, GdipAddPathLine, GdipResetPath, GdipDeletePath, GdipCreatePath, GdipSetStringFormatFlags, GdipDeleteStringFormat, GdipCreateStringFormat, GdipSetPenBrushFill, GdipSetPenColor, GdipDeletePen, GdipCreatePen2, GdipCreatePen1, GdipSetLineColors, GdipCreateLineBrushI, GdipCreateLineBrush, GdipSetSolidFillColor, GdipCreateSolidFill, GdipCloneBrush, GdipDeleteBrush, GdiplusShutdown, GdiplusStartup, GdipBitmapUnlockBits, GdipBitmapLockBits, GdipCreateBitmapFromScan0, GdipCreateBitmapFromFile, GdipGetImagePalette, GdipGetImagePaletteSize, GdipGetImagePixelFormat, GdipGetImageHeight, GdipGetImageWidth, GdipCloneImage, GdipDrawImageI, GdipDeleteGraphics, GdipGetImageGraphicsContext, GdipDisposeImage, GdipAlloc, GdipFree, GdipFillRectangleI
                                                UxTheme.dllDrawThemeBackground, CloseThemeData, OpenThemeData
                                                WINMM.dllmciGetErrorStringW, mciSendCommandW
                                                Language of compilation systemCountry where language is spokenMap
                                                ChineseChina
                                                TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                2024-12-17T20:18:32.582894+01002854802ETPRO MALWARE Suspected Rhadamanthys Related SSL Cert1104.161.43.182845192.168.2.549741TCP
                                                TimestampSource PortDest PortSource IPDest IP
                                                Dec 17, 2024 20:18:31.107403040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:31.227684975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:31.227786064 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:31.228055000 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:31.353553057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:32.461636066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:32.463149071 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:32.582894087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:32.839458942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:32.851249933 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.020802975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293467045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293500900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293514013 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293565989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.293584108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293596983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293665886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.293673038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293682098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.293718100 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.295978069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.296037912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.296053886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.298677921 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.298738003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.298757076 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.306488991 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.306564093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.415920973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.416035891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.416224957 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.485850096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.486010075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.486151934 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.489636898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.491066933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.491141081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.491173029 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.498966932 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.499048948 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.499053955 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.506613970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.506696939 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.506762981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.514394045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.514460087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.514486074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.522032976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.522114038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.522115946 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.529800892 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.529881954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.529894114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.537513018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.537579060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.537627935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.545247078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.545316935 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.545326948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.553011894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.553075075 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.553134918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.560136080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.560220957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.560277939 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.567451000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.567477942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.567548037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.677855015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.677874088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.677983046 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.679181099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.679330111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.679600954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.684101105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.684129953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.684194088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.688915014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.689008951 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.689088106 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.693814993 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.693919897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.694165945 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.698350906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.698448896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.700936079 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.702656031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.702672958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.702718973 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.706990957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.707422018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.707484007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.711236000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.711350918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.711429119 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.715461969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.715532064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.715645075 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.719800949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.719871044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.719928980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.724064112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.724101067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.724198103 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.728395939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.728506088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.728579998 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.732577085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.732744932 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.734731913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.737015009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.737107038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.737411976 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.741236925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.741255999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.741317987 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.745539904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.745645046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.745698929 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.749855042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.749874115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.750504971 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.754019976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.754205942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.754859924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.758244038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.758361101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.758416891 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.762579918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.762716055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.764658928 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.766803026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.766937971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.767045975 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.771164894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.771183014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.771317005 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.801465034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.801575899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.801745892 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.803636074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.855283976 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.880526066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.880552053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.880609989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.882309914 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.883143902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.883204937 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.883236885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.887505054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.887713909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.887748957 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.891756058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.891838074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.891846895 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.895186901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.895239115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.895241976 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.898281097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.898472071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.898474932 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.901515007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.901626110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.901696920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.904726028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.904797077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.904972076 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.907572031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.907665014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.907812119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.910624027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.910676956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.910782099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.913743019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.913801908 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.913866043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.916946888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.917012930 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.917217970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.919941902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.920030117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.920042992 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.923132896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.923158884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.923187971 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.926367044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.926383972 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.926450014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.929337025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.929394007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.929435968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.932503939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.932574987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.932621956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.934287071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.934365034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.934434891 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.936311007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.936367035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.936393023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.938010931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.938029051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.938057899 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.940028906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.940078974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.940124989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.942645073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.942759991 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.942761898 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.943645000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.943696976 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.943722963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.945559978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.945609093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.945645094 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.947443962 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.947498083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.947504044 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.949480057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.949537039 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.949650049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.951246023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.951327085 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.951342106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.953053951 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.953111887 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.953139067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.954905987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.955020905 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.955166101 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.956840038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.956888914 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.956991911 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.958703041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.958760977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.958837986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.960546017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.960604906 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.960695028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.962479115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.962560892 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.962565899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.964376926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.964433908 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.964560986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.966381073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.966430902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.966500044 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:33.968130112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:33.968187094 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.065290928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.065370083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.065524101 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.066274881 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.066318035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.066843033 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.068140984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.068850994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.068866968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.068914890 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.070635080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.070755005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.070833921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.072546005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.072613001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.072642088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.074486971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.074502945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.074562073 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.076280117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.076394081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.076436996 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.078210115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.078265905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.078329086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.080097914 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.080204010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.080275059 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.081984043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.082060099 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.082067966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.083725929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.083791018 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.083817005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.085541010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.085607052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.085654974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.087260008 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.087347031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.087368965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.089037895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.089083910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.089149952 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.090730906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.090791941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.090843916 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.092331886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.092406988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.092434883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.094034910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.094129086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.094670057 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.095907927 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.095925093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.095976114 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.097255945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.097322941 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.097376108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.099109888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.099174023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.099246979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.100406885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.100475073 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.100528002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.102016926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.102255106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.102325916 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.103637934 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.103719950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.103725910 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.105329990 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.105427980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.105628014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.107152939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.107186079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.107230902 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.108530045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.108685970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.108932972 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.110049963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.110122919 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.110140085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.111641884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.111726999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.111799002 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.113354921 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.113481998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.113513947 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.114905119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.115025043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.115096092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.116559982 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.116770029 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.116806030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.118242025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.118294001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.118320942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.119690895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.119731903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.119904995 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.121311903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.121366978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.121613979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.122889996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.122958899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.123040915 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.124524117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.124612093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.124763966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.126188040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.126332045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.126389027 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.127702951 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.127784014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.127815962 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.129631042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.129714012 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.129980087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.131006002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.131022930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.131081104 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.132541895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.132703066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.132733107 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.134143114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.134259939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.134289980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.135803938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.135889053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.135919094 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.137501955 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.137619019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.137692928 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.139408112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.139516115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.139544964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.140634060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.140790939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.140818119 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.142303944 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.142473936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.143115044 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.143943071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.144051075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.144120932 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.145447016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.145509958 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.145570040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.147036076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.147300959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.147365093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.148660898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.148730993 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.149017096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.150324106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.150386095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.150393963 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.199059010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.280076981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.280183077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.280239105 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.280546904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.280666113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.280735970 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.281774044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.281872034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.281930923 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.283020973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.283082008 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.283972979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.284302950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.284425020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.284471989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.285450935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.285554886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.285954952 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.286705017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.286787987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.286901951 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.287868977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.287993908 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.289104939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.289165974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.289186001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.289235115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.290381908 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.290458918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.290759087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.291614056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.291764975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.291860104 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.292821884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.292891979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.293518066 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.294019938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.294060946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.294112921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.295300007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.295378923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.295423985 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.296506882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.296583891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.296787977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.297699928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.297821045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.297873974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.298927069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.299052000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.299241066 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.300170898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.300265074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.300477982 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.301387072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.301493883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.301567078 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.302573919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.302689075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.302747965 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.303809881 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.303852081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.304086924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.305104017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.305119038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.305164099 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.306332111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.306454897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.306554079 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.307506084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.307518005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.307559013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.308803082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.308883905 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.308938980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.309952021 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.310058117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.310255051 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.311197042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.311254025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.311321020 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.312443018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.312585115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.312793016 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.313621998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.313724995 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.313842058 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.314949989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.315026045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.315083027 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.316179037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.316195011 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.316318989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.317331076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.317413092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.317502022 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.318541050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.318604946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.318656921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.319802046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.319895983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.319943905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.321017027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.321122885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.321191072 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.322216988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.322321892 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.322427034 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.323378086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.323462009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.323504925 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.324666977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.324776888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.324954987 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.325854063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.325975895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.326033115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.327102900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.327219009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.327265024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.328412056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.328525066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.328891993 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.329519987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.329649925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.329724073 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.331044912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.331130028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.331180096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.332060099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.332158089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.332204103 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.333225965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.333319902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.333394051 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.334443092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.334551096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.334604025 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.335669041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.335798979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.336007118 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.336935043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.336977005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.337030888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.338123083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.338207960 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.338316917 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.339384079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.339409113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.339495897 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.340598106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.340728998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.340785027 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.341893911 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.341989994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.342703104 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.343101978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.343163013 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.343230963 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.344197989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.386497974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.451087952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.451241970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.451405048 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.451430082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.451598883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.451821089 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.452826023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.452841997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.452903986 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.453692913 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.453710079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.454057932 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.455135107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.455867052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.455926895 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.456556082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.456572056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.456614017 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.457730055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.458045959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.458102942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.458519936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.458535910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.458581924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.459045887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.459110975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.459148884 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.460119963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.460180998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.460252047 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.461325884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.461513996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.461559057 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.462512970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.462584019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.462718010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.463953018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.464422941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.464478970 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.465075970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.465332985 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.465442896 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.466253042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.466370106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.466610909 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.467477083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.467767000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.467912912 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.468987942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.469110012 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.469161987 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.470156908 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.470598936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.470834017 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.471266031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.471383095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.471436024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.472467899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.472753048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.473638058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.473692894 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.473794937 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.473835945 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.474864960 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.475171089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.476018906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.476075888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.476304054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.476356030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.477215052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.477839947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.478545904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.478600979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.478754044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.478806019 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.483238935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.483256102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.483273983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.483289003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.483331919 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.483360052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.483511925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.483527899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.483577013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.484713078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.485079050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.485152006 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.485929012 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.485944986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.486002922 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.487085104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.487277031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.487565994 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.488301039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.488328934 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.488347054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.488369942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.488626957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.488863945 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.489515066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.489603996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.489651918 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.490818977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.490981102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.491359949 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.491961002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.492257118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.492306948 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.493150949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.493304014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.493356943 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.494384050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.494523048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.494636059 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.495618105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.495752096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.495832920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.496819019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.497153044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.497206926 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.498032093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.498300076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.498400927 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.499342918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.499702930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.499749899 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.500533104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.500686884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.500792027 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.502671957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.505589962 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.505603075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.505614042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.505620003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.505626917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.505690098 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.505703926 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.506620884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.506817102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.506892920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.508042097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.508213997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.508322001 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.509089947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.509268999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.509334087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.510484934 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.510660887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.510720968 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.511742115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.512084007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.512132883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.512994051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.513008118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.513149977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.514079094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.514444113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.514496088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.515305042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.558379889 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.643189907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.643208027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.643337011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.643870115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.644011974 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.644115925 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.645178080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.645195007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.645246983 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.646244049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.646703005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.646771908 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.646892071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.647960901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.647978067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.648017883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.649117947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.649173021 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.649279118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.650310040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.650326014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.650357008 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.651268005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.651283979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.651335955 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.652455091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.652510881 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.653328896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.653492928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.653544903 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.653676033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.654643059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.654705048 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.654818058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.655633926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.655718088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.656141996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.656948090 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.656991959 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.657135963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.658087969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.658137083 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.658159018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.659032106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.659045935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.659075022 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.660151958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.660237074 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.661130905 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.661305904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.661318064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.661350965 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.662244081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.662256956 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.662271023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.662307024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.662347078 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.664776087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.664788008 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.664853096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.664935112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.665750980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.665870905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.666044950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.666707039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.666758060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.667377949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.668106079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.668123007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.668145895 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.669253111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.669303894 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.669430017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.670095921 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.670166969 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.671230078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.671241045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.671287060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.671400070 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.672384977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.672482967 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.673578024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.673589945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.673608065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.673640013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.674592018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.674638033 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.674758911 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.675642967 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.675688982 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.676156044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.676810026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.676876068 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.677169085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.677834034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.677999973 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.678170919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.678987980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.679042101 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.679168940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.680160999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.680226088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.680504084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.681302071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.681340933 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.682481050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.682492971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.682514906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.682540894 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.683646917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.683765888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.683826923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.684665918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.684711933 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.685623884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.685798883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.685811043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.685853004 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.686984062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.687040091 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.687503099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.688169003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.688225031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.688330889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.689485073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.689570904 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.689681053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.690017939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.690054893 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.690361023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.691354036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.691401958 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.691518068 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.692503929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.692636967 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.693316936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.693806887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.693855047 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.694145918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.694878101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.694924116 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.695573092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.695770025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.695781946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.695817947 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.696836948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.696903944 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.697009087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.698023081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.698086023 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.699018002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.699029922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.699047089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.699060917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.699074030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.699074984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.699132919 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.699955940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.700011015 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.701220989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.745906115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.833647966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.833856106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.833930969 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.834220886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.834815979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.835017920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.835072041 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.835143089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.835190058 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.836163044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.836256981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.837119102 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.837255001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.837378025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.838412046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.838423967 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.838474035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.839483976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.839715958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.839823008 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.840650082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.840838909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.840889931 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.841705084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.841885090 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.841960907 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.842822075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.843453884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.843502045 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.843951941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.844120026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.844172955 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.845043898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.845213890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.845276117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.846271038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.846385002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.846426010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.847268105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.847409964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.847465038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.848364115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.848632097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.848681927 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.849566936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.849579096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.849623919 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.850609064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.851733923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.851792097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.851802111 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.851803064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.851843119 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.852890968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.853261948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.853316069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.853956938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.854703903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.854759932 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.855181932 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.855195045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.855261087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.856210947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.856223106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.856266022 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.857284069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.857963085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.858006954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.858514071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.858527899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.858576059 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.859517097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.859703064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.859762907 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.860690117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.861002922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.861057997 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.861850023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.861993074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.862107038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.862998009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.863281965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.863334894 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.863974094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.864111900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.864547014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.865123987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.865220070 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.865266085 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.866199970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.866292953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.866548061 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.867409945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.867539883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.867580891 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.868421078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.868577957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.868630886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.869563103 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.869858027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.869913101 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.870745897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.870973110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.871357918 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.871790886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.871928930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.871980906 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.872857094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.873002052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.873450994 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.874031067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.874327898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.874363899 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.875093937 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.875325918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.875374079 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.876185894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.876364946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.876425982 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.877289057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.877629995 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.877695084 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.878410101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.878599882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.878741980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.879762888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.879862070 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.879926920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.880661011 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.880752087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.881030083 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.881808996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.882390022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.882482052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.882900000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.883147001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.883197069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.884187937 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.884504080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.884557009 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.885112047 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.885346889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.885401011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.886256933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.886430025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.886488914 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.887353897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.887511969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.887588024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.888499022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.888657093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.888705969 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.889717102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.889893055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.889940977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.890688896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.890863895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.890917063 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:34.891772985 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:34.933371067 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.025763035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.025852919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.025934935 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.026431084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.026529074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.026582956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.027899981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.027913094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.027957916 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.028683901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.028932095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.028985977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.029088020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.030035019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.030071974 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.030096054 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.031052113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.031131029 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.031161070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.032166004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.032222033 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.032285929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.033329010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.033371925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.033425093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.034398079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.034456968 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.034554005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.035511017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.035567045 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.036134005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.036649942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.036689043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.036720037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.037760019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.037806988 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.038130045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.038865089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.038922071 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.039047003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.040137053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.040194035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.040260077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.041156054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.041207075 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.041486025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.042361975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.042408943 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.043191910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.043574095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.043586016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.043629885 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.044569969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.044615030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.044845104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.045739889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.045838118 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.045998096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.046745062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.046832085 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.047918081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.047934055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.047946930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.047986031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.048947096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.049011946 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.050122023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.050173044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.050185919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.050213099 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.051516056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.051979065 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.052352905 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.052776098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.052787066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.052819967 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.053726912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.053829908 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.053980112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.054984093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.055027008 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.055090904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.056209087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.056262016 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.056351900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.057564020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.057640076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.057657003 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.058432102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.058568954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.059045076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.059458971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.059509993 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.059751034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.060359001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.060410023 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.060530901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.061297894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.061310053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.061353922 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.062202930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.062243938 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.062437057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.063380957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.063431978 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.063746929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.064430952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.064488888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.064979076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.065537930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.065697908 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.065893888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.066879988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.066940069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.067161083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.068097115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.068145037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.068156004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.069034100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.069082975 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.069809914 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.070178986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.070234060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.070660114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.071252108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.071340084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.071382999 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.072371960 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.072494984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.072518110 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.073425055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.073532104 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.073868036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.074502945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.074553013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.074834108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.075576067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.075632095 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.075948000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.076663971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.076709986 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.077845097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.077858925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.077872038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.077922106 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.079476118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.079528093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.079788923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.080455065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.080506086 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.080946922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.081444979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.081490993 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.081826925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.082634926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.082690001 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.082746983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.084018946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.084084034 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.084314108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.136513948 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.224831104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.224889040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.224992037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.225397110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.225542068 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.225585938 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.226496935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.226902008 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.226973057 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.226980925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.228003025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.228081942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.228187084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.229271889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.229393959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.229453087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.230302095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.230314016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.230391026 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.231372118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.231424093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.231776953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.232438087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.232516050 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.233510971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.233618021 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.233630896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.233737946 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.234699965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.234743118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.234819889 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.235801935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.235872030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.236049891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.236932039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.236984015 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.237132072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.238308907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.238343000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.238354921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.239137888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.239201069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.239360094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.240295887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.240495920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.240566015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.241389990 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.241453886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.241517067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.242486954 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.242566109 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.243479013 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.243613005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.243626118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.243801117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.244745016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.244800091 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.245214939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.245969057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.246032000 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.246155024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.246927023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.246995926 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.247145891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.248058081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.248379946 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.248472929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.249202013 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.249264956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.249627113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.250359058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.250405073 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.250771046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.251450062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.251492977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.251899958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.252522945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.252636909 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.252949953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.253591061 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.253833055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.253894091 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.254741907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.254859924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.254956961 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.255808115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.255858898 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.256028891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.257024050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.257036924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.257093906 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.258068085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.258138895 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.259213924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.259227037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.259331942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.259356976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.260394096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.260449886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.260519981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.261399984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.262136936 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.262412071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.262509108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.262520075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.262557030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.263953924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.263966084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.264027119 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.264705896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.264775038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.264884949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.265892982 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.265933037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.265955925 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.266937017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.266994953 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.267767906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.268090010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.268100977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.268141031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.269167900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.269290924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.269577026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.270353079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.270430088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.270987034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.271415949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.271461964 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.271775007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.272557974 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.272614956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.272675037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.273667097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.273679018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.273783922 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.274734020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.274781942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.274854898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.275840998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.275896072 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.276192904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.277053118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.277156115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.277323008 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.278120995 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.278248072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.278279066 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.279185057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.279259920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.279287100 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.280311108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.280360937 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.280591965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.281513929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.282026052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.282668114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.282684088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.282721996 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.284109116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.339668036 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.417714119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.417726040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.417790890 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.418092966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.418104887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.418160915 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.419163942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.419183016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.419226885 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.420094013 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.420250893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.420624971 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.420990944 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.421171904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.421212912 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.422094107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.422106981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.422148943 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.423176050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.423187017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.423235893 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.424349070 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.424416065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.424633980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.425467968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.425678015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.425730944 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.426534891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.426709890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.426753044 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.427643061 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.428157091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.428493023 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.430032969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.430044889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.430058002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.430071115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.430088043 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.430114985 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.430915117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.431101084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.431185007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.432009935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.432183027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.432512045 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.433123112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.433293104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.433365107 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.433486938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.434711933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.434748888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.435683966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.435697079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.435736895 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.436619043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.436779976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.436825991 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.437555075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.437895060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.437985897 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.438715935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.438890934 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.439222097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.439234972 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.439276934 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.439304113 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.440206051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.440301895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.440608025 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.441333055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.441529036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.441581011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.442548990 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.442562103 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.442605972 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.443514109 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.443531036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.443593025 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.444628954 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.444729090 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.445116997 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.445794106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.445925951 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.445996046 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.446885109 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.447000027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.447041988 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.448196888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.448298931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.448514938 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.449181080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.449290037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.450309992 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.450371981 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.450395107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.450634003 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.451339960 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.451391935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.451438904 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.452388048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.452532053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.453306913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.453541994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.453634024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.453680992 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.457581043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458015919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458066940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458074093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.458097935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458113909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458129883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458141088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.458168030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.458287001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458857059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.458909035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.459892988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.460071087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.460165024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.461083889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.461096048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.461136103 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.462069035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.462228060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.462807894 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.463255882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.463423014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.463491917 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.464236975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.464385033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.464497089 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.465549946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.465708971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.466650009 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.466917038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.466928959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.466981888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.468038082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.468198061 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.468255997 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.469156981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.469315052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.469379902 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.470175982 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.470189095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.470244884 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.471298933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.471451998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.471833944 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.472507000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.472520113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.472563982 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.473660946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.473819971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.473961115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.474632978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.474802017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.474858999 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.475668907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.475682020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.475735903 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.609101057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.609155893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.609569073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.609677076 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.609754086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.610651016 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.610780001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.610975027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.611035109 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.611831903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.612165928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.612227917 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.612287045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.613266945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.613375902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.613449097 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.614408016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.614420891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.614471912 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.615489006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.615504026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.616831064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.616899967 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.616945028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.618249893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.618360043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.618922949 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.619472980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.619606972 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.619611025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.620418072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.620472908 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.620529890 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.621279001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.621330023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.621336937 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.622167110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.622236013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.622265100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.623297930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.623366117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.623398066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.624413013 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.624520063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.624562979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.625540972 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.625659943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.625701904 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.626703978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.626811028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.626837015 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.627741098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.627866983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.627896070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.628912926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.628973007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.630238056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.630290031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.630419016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.631174088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.631268978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.631962061 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.632278919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.632329941 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.632410049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.633366108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.633445978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.633492947 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.634659052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.634673119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.635373116 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.635672092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.635710955 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.635736942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.636624098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.636727095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.637753963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.637806892 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.637819052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.637831926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.639007092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.639091015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.639122963 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.640172958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.640208006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.641119003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.641168118 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.641258001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.642460108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.642508984 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.642592907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.643451929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.643574953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.643584013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.644610882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.644634962 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.644679070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.645560026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.645636082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.645677090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.646678925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.646765947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.646892071 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.647766113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.647880077 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.647964954 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.648905039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.649005890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.649008989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.649997950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.650044918 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.650096893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.651155949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.651220083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.651247978 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.652245998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.652343035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.652554035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.653388977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.653507948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.653563023 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.654447079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.654493093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.654561043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.655574083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.655620098 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.655662060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.656683922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.656725883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.656780005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.657819986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.657871962 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.657932997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.659066916 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.659136057 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.659158945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.660037994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.660085917 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.660108089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.661119938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.661251068 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.661309004 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.662286997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.662343025 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.662365913 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.663373947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.663418055 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.663424969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.664491892 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.664537907 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.664541960 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.665586948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.665628910 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.665710926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.666685104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.666737080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.667830944 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.692641973 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.692779064 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.801409006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.801474094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.801537037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.801883936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.801992893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.802073956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.803080082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.803242922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.803653002 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.804393053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.804625988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.804805040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.804848909 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.805780888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.805883884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.805939913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.806798935 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.806843996 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.806991100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.807799101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.807847023 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.808134079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.808943033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.809017897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.809078932 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.810076952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.810236931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.810293913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.811212063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.811405897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.812024117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.812289000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.812338114 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.812397003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.813379049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.813431978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.813483953 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.814483881 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.814528942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.814853907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.815567017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.815614939 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.815814972 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.816701889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.816745996 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.816802979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.817825079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.817866087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.817871094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.818905115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.819020033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.820046902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.820100069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.820172071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.821122885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.821166039 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.821233034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.822352886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.822407007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.822489977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.823368073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.823493958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.824687004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.824700117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.824742079 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.825664043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.825721025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.825766087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.826692104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.826792002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.827804089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.827862024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.828030109 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.829021931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.829072952 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.829309940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.830060005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.830104113 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.830179930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.831151009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.831285954 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.832416058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.832473040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.832621098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.833488941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.833543062 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.833627939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.834562063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.834609032 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.834640026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.835639000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.835681915 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.835727930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.836683035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.836755037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.836811066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.837856054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.837902069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.837960958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.838979959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.839189053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.840050936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.840101004 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.840132952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.841183901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.841253042 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.841310024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.842384100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.842433929 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.842467070 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.843417883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.843498945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.844521046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.844579935 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.844655037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.845599890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.845649004 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.845756054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.846730947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.846915007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.847851992 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.847904921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.848001003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.849170923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.849370003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.849375010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.850383997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.850440025 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.850505114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.851300001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.851356030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.852372885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.852395058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.852427959 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.853490114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.853585958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.853627920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.854547977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.854629040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.854660034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.855735064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.855787992 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.855803967 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.856744051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.856817007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.856992006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.857877016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.857944012 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.857975006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.858942986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.859040976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.862652063 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.993546963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.993675947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.994008064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.994093895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.994123936 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.994170904 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.994852066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.995022058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.995994091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.996051073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.996057987 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.996332884 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.996551991 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.996716022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.996809006 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.997731924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.997792006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.997853041 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.998836994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.998969078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:35.999022007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:35.999979973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.000171900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.000219107 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.001085043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.001247883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.001333952 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.002146006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.002269983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.002480030 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.003251076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.003338099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.003482103 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.004488945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.004854918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.004913092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.005506992 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.005697966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.005821943 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.006599903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.006730080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.006769896 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.007715940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.007788897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.008186102 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.008855104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.008982897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.009152889 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.009907007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.010051966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.010102034 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.011075020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.011151075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.012137890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.012233973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.012290955 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.013272047 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.013375044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.013427019 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.014417887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.014636993 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.015079975 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.015487909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.015594959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.016602993 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.016690016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.016752958 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.017698050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.017859936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.017918110 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.018819094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.019052029 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.019951105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.020009995 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.020087004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.021035910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.021090031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.021210909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.022203922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.022294044 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.022430897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.022473097 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.023298025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.023459911 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.023530006 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.024421930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.024533033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.025511026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.025612116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.025672913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.026616096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.026716948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.027718067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.027785063 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.027797937 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.028845072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.028896093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.028960943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.029947042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.030004978 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.030090094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.030628920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.031232119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.031249046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.032206059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.032259941 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.032675028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.033276081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.033322096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.033700943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.034477949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.034636974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.034645081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.035517931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.035562992 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.035665989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.036607981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.036664963 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.036710978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.036787987 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.037745953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.038069010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.038635969 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.038892984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.038919926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.038969040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.040021896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.040097952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.040148020 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.041079044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.041135073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.041186094 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.042218924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.042332888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.042381048 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.043281078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.043380976 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.043428898 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.044464111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.044614077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.045403004 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.045526028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.045681953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.045737028 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.046848059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.046875000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.048057079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.048114061 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.048158884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.049143076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.049190044 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.049439907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.049483061 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.050254107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.050327063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.050632954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.051642895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.051748037 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.051799059 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.367407084 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.491162062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.491301060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.491341114 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.491693020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.491805077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.491846085 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.492775917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.492923975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.492971897 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.493700027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.493799925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.493841887 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.494702101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.494839907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.494891882 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.495915890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.496041059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.496083975 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.496859074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.496928930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.496973038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.497565985 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.497632980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.497673035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.498656988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.498739958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.498785019 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.499521017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.499689102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.499737024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.500525951 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.500644922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.500686884 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.501564026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.501709938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.501753092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.502552986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.502670050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.502716064 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.503561974 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.503652096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.503691912 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.504479885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.504573107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.504614115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.505520105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.505609035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.505656958 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.506493092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.506618023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.506663084 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.507489920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.507507086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.507548094 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.508460045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.508691072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.508730888 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.509428024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.509485006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.509527922 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.510433912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.510499001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.510550022 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.511476040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.511574984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.511615038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.512449026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.512532949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.512586117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.513485909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.513629913 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.513670921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.514555931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.514678001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.514719009 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.515407085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.515520096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.515566111 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.516395092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.516494036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.516535997 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.517386913 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.517482996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.517520905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.518356085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.518491983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.518532991 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.519385099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.519499063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.519540071 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.520342112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.520458937 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.520502090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.521348953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.521461010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.521503925 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.522310019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.522427082 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.522471905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.523415089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.523536921 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.523577929 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.524336100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.524447918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.524487972 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.524596930 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.525330067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.525427103 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.525469065 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.526289940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.526345968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.526395082 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.527287006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.527441978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.527487040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.528332949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.528557062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.528600931 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.529331923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.529601097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.529642105 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.530304909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.530448914 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.530495882 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.531346083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.531477928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.531522036 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.532423019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.532541990 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.532587051 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.533380032 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.533466101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.533508062 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.534296036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.534373999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.534508944 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.535270929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.535379887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.535425901 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.536305904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.536457062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.536499023 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.537199020 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.537321091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.537360907 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.538216114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.538413048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.538454056 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.539242983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.539383888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.539422035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.540152073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.540277958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.540318012 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.541143894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.541264057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.541305065 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.542174101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.542365074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.542407036 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.543145895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.543287039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.543338060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.544182062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.544270039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.544326067 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.545193911 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.545274019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.545315027 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.546140909 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.546202898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.546247959 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.547080994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.547210932 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.547255039 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.548108101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.548207045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.548250914 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.549205065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.549262047 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.549310923 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.550106049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.550204992 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.550246954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.551100016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.551311016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.551367998 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.552081108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.552144051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.552194118 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.553109884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.553183079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.553227901 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.554081917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.554156065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.554203033 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.555032969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.555160046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.555207968 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.556061983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.556220055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.556277990 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.557024002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.557261944 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.557307959 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.558012962 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.558130980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.558177948 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.559010983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.559173107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.559206963 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.559993029 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.560139894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.560185909 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.560998917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.561182022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.561233997 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.561964989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.562041998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.562088966 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.562987089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.563189030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.563230038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.563977003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.564085007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.564125061 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.564915895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.565048933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.565092087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.565956116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.565973043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.566010952 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.567188025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.567286968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.567328930 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.567902088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.568134069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.568175077 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.568872929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.568990946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.569045067 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.569960117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.570075035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.570120096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.570903063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.570998907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.571043015 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.571901083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.571981907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.572022915 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.572839975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.572956085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.573004007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.573874950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.574120045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.574161053 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.574915886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.575030088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.575071096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.575841904 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.576031923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.576071978 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.576875925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.577075005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.577119112 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.577845097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.577933073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.577982903 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.578902006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.579020977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.579066038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.579811096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.579921007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.579962015 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.580853939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.580910921 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.580952883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.581795931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.581918001 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.581955910 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.582818985 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.582947016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.582988977 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.583807945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.583823919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.583861113 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.584753036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.584808111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.584852934 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.585766077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.585819006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.585860014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.586246014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.586343050 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.586838961 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.586915970 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.586955070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.587748051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.587846041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.587888002 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.588789940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.588917017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.588958979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.589814901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.589895964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.589940071 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.590734005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.590750933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.590790033 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.591702938 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.591814995 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.591856956 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.592742920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.592853069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.592894077 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.593713999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.593808889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.593849897 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.594687939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.594852924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.594894886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.613444090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.613461971 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.686922073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.687078953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.687128067 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.687230110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.687402010 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.687443018 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.688168049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.688237906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.688278913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.689043999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.689069986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.689110041 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.690037012 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.690197945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.690243959 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.690984011 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.691096067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.691142082 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.691939116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.692089081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.692131042 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.692934036 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.693116903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.693161011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.693939924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.694138050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.694180965 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.694859982 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.695054054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.695100069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.695837021 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.695964098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.696006060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.696887016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.697021008 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.697066069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.697813988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.697976112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.698019981 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.698812962 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.698990107 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.699035883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.699780941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.699825048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.699867010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.700757027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.700927019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.700968027 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.701744080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.701889038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.701936960 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.702697039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.702838898 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.702877998 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.703723907 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.703803062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.703844070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.704713106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.704812050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.704854965 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.705713034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.705810070 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.705858946 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.706589937 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.706693888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.706733942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.707259893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.707411051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.707457066 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.707967997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.708134890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.708173990 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.708781004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.708844900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.708887100 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.709558964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.709656000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.709702969 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.710376024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.710496902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.710541964 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.711186886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.711287022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.711329937 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.711993933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.712131023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.712173939 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.712708950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.712896109 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.712940931 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.713443041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.713512897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.713560104 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.714318991 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.714428902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.714471102 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.715070009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.715154886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.715202093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.715845108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.715907097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.715954065 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.716609955 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.716793060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.716836929 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.732559919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.732598066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.732651949 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.732774973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.732793093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.732839108 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.733395100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.733505011 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.733553886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.734275103 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.734339952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.734385967 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.735023975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.735121012 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.735172987 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.735807896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.735889912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.735937119 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.736565113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.736660957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.736710072 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.737291098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.737521887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.737570047 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.738084078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.738171101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.738217115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.738950014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.739089966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.739139080 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.739689112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.739742041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.739797115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.740515947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.740632057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.740678072 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.741189003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.741269112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.741312981 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.742078066 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.742149115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.742199898 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.742986917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.743154049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.743205070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.743932009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.744035959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.744095087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.744805098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.744904995 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.744952917 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.745443106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.745558977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.745598078 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.746184111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.776767015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.776798964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.776817083 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.776947975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.776992083 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.777055025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.777708054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.777755976 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.777777910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.778522968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.778597116 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.778670073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.779041052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.779082060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.779115915 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.779827118 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.779867887 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.779946089 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.780601978 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.780648947 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.780755997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.781392097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.781445026 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.781485081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.782187939 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.782233000 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.782293081 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.782938004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.782985926 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.783009052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.783751965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.783797979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.783876896 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.784480095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.784524918 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.784586906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.785234928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.785276890 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.785401106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.786060095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.786120892 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.786293030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.786854982 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.786900043 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.787008047 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.787617922 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.787668943 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.787697077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.788357019 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.788405895 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.788541079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.789227962 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.789269924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.789355040 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.790292025 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.790340900 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.790693998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.791100979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.791156054 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.791237116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.791913033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.791965961 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.791999102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.792416096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.792459011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.792473078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.793065071 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.793112040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.793190002 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.793833017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.793876886 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.793962955 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.794619083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.794660091 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.794787884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.795409918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.795453072 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.795536041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.796176910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.796221018 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.796251059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.796957016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.796996117 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.797091961 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.797753096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.797807932 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.797842979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.798511028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.798557043 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.798681974 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.799283028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.799333096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.799422026 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.800077915 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.800120115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.800220966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.800860882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.800904989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.800935984 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.801760912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.801809072 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.801845074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.802409887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.802457094 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.802486897 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.803232908 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.803280115 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.803307056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.804071903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.804116011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.804173946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.804898977 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.804945946 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.805191994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.805546045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.805588961 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.805649996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.806348085 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.806392908 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.806427956 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.807080030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.807128906 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.807152033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809482098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809535980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.809554100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809571028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809607029 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.809642076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809660912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809694052 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.809696913 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.810269117 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.810311079 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.810446024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.811089039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.811136961 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.811218023 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.811836958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.811881065 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.811906099 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.812568903 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.812613964 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.812705994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.813380957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.813436031 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.813514948 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.814189911 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.814230919 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.814271927 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.814919949 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.814965010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.815005064 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.815680981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.815722942 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.815763950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.816443920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.816497087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.816566944 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.817295074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.817337990 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.817364931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.870881081 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.968957901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.968991041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969008923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969046116 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.969093084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969147921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.969376087 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969436884 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969463110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969475985 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.969481945 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.969520092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.970105886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.970197916 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.970241070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.970267057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.970293999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.970331907 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.971024990 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.971111059 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.971127987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.971155882 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.971190929 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.971232891 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.971903086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972016096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972033024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972049952 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972059011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.972089052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.972743988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972784042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972800016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972824097 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.972851038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.972891092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.973681927 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.973763943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.973787069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.973900080 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.973929882 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.973941088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.974549055 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.974622011 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.974637985 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.974661112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.974668980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.974699020 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.975379944 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.975439072 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.975455046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.975481033 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.975541115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.975581884 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.976273060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.976399899 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.976416111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.976438999 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.976500034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.976536036 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.977180958 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.977266073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.977282047 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.977312088 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.977380991 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.977427006 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.978037119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.978089094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.978105068 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.978132010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.978230953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.978270054 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.978941917 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.978981018 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.978996038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.979017973 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.979103088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.979149103 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.979862928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.979913950 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.979929924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.979957104 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.980035067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.980073929 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.980777979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.980806112 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.980822086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.980838060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.980846882 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.980876923 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.981596947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.981666088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.981682062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.981698990 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.981709003 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.981735945 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.982460022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.982532024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.982547045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.982597113 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.982656956 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.982698917 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.983467102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.983486891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.983500957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.983525038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.983542919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.983582020 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.984215021 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.984262943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.984275103 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.984301090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.984388113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.984426975 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.985155106 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.985196114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.985208035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.985240936 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.985378027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.985419035 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.985985994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.986035109 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.986047983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.986074924 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.986110926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.986150980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.986951113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.986993074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987004042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987030029 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.987087965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987124920 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.987893105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987942934 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987961054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987974882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.987977028 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.988013029 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.988950014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.988970041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.988984108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.989011049 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.989165068 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.989232063 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.989763975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.989777088 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.989789009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.989800930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.989820004 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.989834070 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.990456104 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.990499973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.990511894 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.990545034 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.990603924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.990643024 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.991372108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.991411924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.991424084 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.991451979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:36.991458893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:36.991497993 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.161698103 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161715031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161725998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161807060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.161849022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161889076 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.161910057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161923885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161962986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.161966085 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.162763119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.162821054 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.162853956 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.162867069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.162904978 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.162985086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.163630009 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.163647890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.163661957 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.163671017 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.163698912 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.163786888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.164541960 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.164554119 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.164585114 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.164594889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.164633989 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.164727926 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.165460110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.165503979 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.165559053 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.165571928 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.165581942 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.165605068 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.166349888 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.166395903 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.166414022 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.166425943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.166464090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.166493893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.167263985 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.167335033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.167349100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.167397976 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.167465925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.168071032 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.168132067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.168143988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.168186903 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.168245077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.168946981 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.168992996 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.169003963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.169018030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.169059038 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.169061899 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.169893980 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.169940948 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.169956923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.169967890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.170006037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.170032024 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.170754910 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.170799971 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.170811892 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.170856953 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.170877934 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.171655893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.171691895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.171704054 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.171710014 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.171741009 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.171755075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.172590017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.172609091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.172620058 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.172648907 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.172667027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.172667980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.173393965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.173433065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.173444033 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.173491955 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.173561096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.174371004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.174417973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.174418926 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.174432039 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.174477100 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.174555063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.175229073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.175280094 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.175292015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.175302982 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.175332069 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.176043034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.176088095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.176110029 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.176131010 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.176158905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.176184893 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.176933050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.176980972 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.176991940 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.177032948 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.177062035 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.177855015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.177866936 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.177879095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.177902937 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.177918911 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.177978992 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.178721905 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.178741932 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.178754091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.178798914 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.178838968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.179589987 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.179632902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.179639101 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.179646015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.179682970 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.179708004 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.180488110 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.180531979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.180541992 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.180543900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.180583954 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.180610895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.181354046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.181368113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.181401968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.181402922 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.181529045 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.181577921 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.182235003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.182269096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.182276964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.182318926 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.182393074 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.183141947 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.183160067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.183172941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.183222055 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.183248043 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.184050083 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.184091091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.184092999 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.184125900 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.184161901 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.184168100 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.230267048 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.361429930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361486912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361521959 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361577988 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361670017 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.361783981 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.361807108 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361840963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361876965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.361917019 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.362323999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.362431049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.362466097 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.362478971 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.362504005 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.362545013 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.363224983 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.363331079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.363365889 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.363380909 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.363401890 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.363471985 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.364198923 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.364295006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.364331007 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.364341974 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.364402056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.364459038 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.365068913 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.365170956 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.365206003 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.365235090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.365251064 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.365278006 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.365926027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366009951 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366044044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366080046 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366101980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.366808891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366857052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.366863012 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366899014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.366942883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.367008924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.367672920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.367727041 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.367727995 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.367763042 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.367798090 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.367810011 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.368633986 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.368668079 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.368689060 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.368705034 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.368741989 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.368755102 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.369437933 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.369503975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.369538069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.369573116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.369596958 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.370299101 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.370352030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.370361090 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.370388031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.370433092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.370455027 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.371186972 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.371242046 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.371294975 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.371345997 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.371381998 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.371397972 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.372057915 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.372112036 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.372113943 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.372148991 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.372212887 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.372231007 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.372935057 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.372981071 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.372998953 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.373034000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.373069048 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.373081923 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.373925924 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.373976946 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374011993 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374068975 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.374088049 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374756098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374806881 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.374808073 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374842882 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374878883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.374895096 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.375653028 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.375685930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.375700951 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.375725031 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.375758886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.375775099 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.376555920 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.376590014 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.376609087 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.376626968 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.376662016 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.376677990 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.377464056 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.377513885 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.377556086 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.377590895 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.377640963 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.377718925 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.378489017 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.378523111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.378544092 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.378559113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.378595114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.378617048 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.379179955 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.379232883 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.379271030 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.379306078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.379352093 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.379352093 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.380212069 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.380269051 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.380315065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.380350113 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.380395889 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.380414963 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.381072044 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.381124973 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.381159067 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.381221056 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.381230116 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.381943941 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.381998062 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.381998062 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.382034063 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.382070065 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.382083893 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.382949114 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.382991076 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.383004904 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.383027077 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.383060932 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.383078098 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.383972883 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.384007931 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.384025097 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.384044886 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.384078979 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.384093046 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.433520079 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.553754091 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.553833961 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.553870916 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.553900957 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.553905964 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.553944111 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.553977966 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.553987026 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.554018974 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.554028034 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.554421902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.554477930 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.554514885 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.554537058 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.554552078 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.554568052 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.555381060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.555418015 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.555454969 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.555479050 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.555512905 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.555545092 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.556230068 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.556287050 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.556322098 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.556375980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.556375980 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.556391954 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.557058096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.557097912 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.557135105 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.557157040 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.557172060 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.557177067 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.557934999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.557996988 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.558005095 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558041096 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558090925 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.558111906 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558837891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558892965 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.558892965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558948994 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558986902 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.558998108 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.559801102 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.559851885 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.559900999 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.559937000 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.560003996 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.560051918 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.560583115 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.560640097 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.560648918 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.560684919 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.560734034 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.560852051 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.561520100 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.561572075 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.561611891 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.561629057 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.564892054 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.574676037 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.574748993 CET497412845192.168.2.5104.161.43.18
                                                Dec 17, 2024 20:18:37.694566965 CET284549741104.161.43.18192.168.2.5
                                                Dec 17, 2024 20:18:37.694601059 CET284549741104.161.43.18192.168.2.5

                                                Click to jump to process

                                                Click to jump to process

                                                Click to dive into process behavior distribution

                                                Click to jump to process

                                                Target ID:0
                                                Start time:14:18:09
                                                Start date:17/12/2024
                                                Path:C:\Users\user\Desktop\37O0XUq6Vp.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\Desktop\37O0XUq6Vp.exe"
                                                Imagebase:0x400000
                                                File size:1'861'632 bytes
                                                MD5 hash:262C88E2E99892879212FADAE43C050E
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:low
                                                Has exited:true

                                                Target ID:3
                                                Start time:14:18:25
                                                Start date:17/12/2024
                                                Path:C:\Users\user\Desktop\37O0XUq6Vp.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Users\user\Desktop\37O0XUq6Vp.exe"
                                                Imagebase:0x400000
                                                File size:1'861'632 bytes
                                                MD5 hash:262C88E2E99892879212FADAE43C050E
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Yara matches:
                                                • Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000003.00000003.2304302873.0000000000870000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000003.00000002.2327001865.0000000000AB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000003.2309415672.00000000030A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000003.00000003.2309169852.0000000002E80000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                Reputation:low
                                                Has exited:true

                                                Target ID:4
                                                Start time:14:18:27
                                                Start date:17/12/2024
                                                Path:C:\Windows\SysWOW64\svchost.exe
                                                Wow64 process (32bit):true
                                                Commandline:"C:\Windows\System32\svchost.exe"
                                                Imagebase:0x540000
                                                File size:46'504 bytes
                                                MD5 hash:1ED18311E3DA35942DB37D15FA40CC5B
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Yara matches:
                                                • Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000003.2311812189.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000003.2314258818.0000000005580000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000003.2314486062.00000000057A0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
                                                • Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000004.00000002.2404303349.0000000003680000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
                                                Reputation:high
                                                Has exited:true

                                                Target ID:7
                                                Start time:14:18:28
                                                Start date:17/12/2024
                                                Path:C:\Windows\SysWOW64\WerFault.exe
                                                Wow64 process (32bit):true
                                                Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 452
                                                Imagebase:0x580000
                                                File size:483'680 bytes
                                                MD5 hash:C31336C1EFC2CCB44B4326EA793040F2
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                Target ID:8
                                                Start time:14:18:36
                                                Start date:17/12/2024
                                                Path:C:\Windows\System32\fontdrvhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:"C:\Windows\System32\fontdrvhost.exe"
                                                Imagebase:0x7ff7b5950000
                                                File size:827'408 bytes
                                                MD5 hash:BBCB897697B3442657C7D6E3EDDBD25F
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:true

                                                Target ID:10
                                                Start time:14:18:39
                                                Start date:17/12/2024
                                                Path:C:\Windows\System32\WerFault.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\WerFault.exe -u -p 1812 -s 140
                                                Imagebase:0x7ff6f0ad0000
                                                File size:570'736 bytes
                                                MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                Reset < >

                                                  Execution Graph

                                                  Execution Coverage:0.1%
                                                  Dynamic/Decrypted Code Coverage:0%
                                                  Signature Coverage:0%
                                                  Total number of Nodes:10
                                                  Total number of Limit Nodes:0
                                                  execution_graph 60285 451620 60286 451651 ExitProcess 60285->60286 60288 44fbbd 60289 44fbcc VirtualProtect 60288->60289 60291 44fcbe 60289->60291 60293 44fd11 60291->60293 60297 45035e 13 API calls 60293->60297 60298 439b69 60299 439b9a VirtualProtect 60298->60299 60301 439ca8 60299->60301
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: c28c11593cfe79d28bfc625eb4682ff4d93173789255eb7d211fb3372e8b3fcc
                                                  • Instruction ID: a0a42fdd9e4101b5ce380e6192388b8392f78ccbf18b1f25960e01df642eed19
                                                  • Opcode Fuzzy Hash: c28c11593cfe79d28bfc625eb4682ff4d93173789255eb7d211fb3372e8b3fcc
                                                  • Instruction Fuzzy Hash: 0BD1E3B1D042659BEB248B10DC54BEAB7B5EF98300F1490FEE44DA7380DA795FC18B66

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 0 44839d-4483bb 1 4483cd 0->1 2 4483bd-4483c7 0->2 4 4483d7-448788 call 448431 call 448446 NtQueryDefaultLocale 1->4 2->1 3 448183-4481db 2->3 7 4481e2-4482a9 3->7 35 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 4->35 36 44878e-4487e1 4->36 13 4482c3-4482d3 7->13 14 4482ab-4482c1 7->14 13->7 17 4482d9-4482ec 13->17 16 448326-448390 call 44839d 14->16 32 448395-44839b 16->32 17->7 20 4482f2-448302 17->20 24 448304-44830e 20->24 25 448310 20->25 24->4 28 44831a-448320 24->28 25->28 28->16 69 448d2c-448ea7 call 448ea8 35->69 70 449639-449d4a 35->70 38 4487f2-4487fe 36->38 40 448826-448850 38->40 41 448800-448817 38->41 43 448853-4488de 40->43 44 448824 41->44 45 448819-448822 41->45 50 4488ef-4488fb 43->50 44->38 45->43 52 448923-44894d 50->52 53 4488fd-448914 50->53 52->35 55 448916-44891f 53->55 56 448921 53->56 55->35 56->50 82 449d50-449dd5 70->82 83 449f43-449fba call 449f55 70->83 87 449de6-449df2 82->87 93 449fcb-449ff1 83->93 89 449df4-449e0b 87->89 90 449e1a-449e44 87->90 91 449e0d-449e16 89->91 92 449e18 89->92 94 449e47-449ed1 90->94 91->94 92->87 99 449ff3-449ffc 93->99 100 449ffe 93->100 98 449ee2-449eee 94->98 101 449f16-449f40 98->101 102 449ef0-449f07 98->102 103 44a02b-44a101 call 44a042 call 44a059 99->103 100->103 104 449fbc-449fc5 100->104 105 449f14 102->105 106 449f09-449f12 102->106 115 44a107-44a113 103->115 104->93 105->98 106->83 116 44a2a0-44a2ef 115->116 117 44a119-44a17b 115->117 122 44a300 116->122 123 44a2f1-44a2fb 116->123 120 44a260-44a279 117->120 121 44a181-44a192 call 44a194 117->121 126 44a28c-44a295 120->126 127 44a27b-44a28a 120->127 125 44a4ba-44a4c1 122->125 123->125 130 44a4c3-44a4c9 125->130 131 44a4cf-45036c call 45035e call 45036d 125->131 128 44a29b 126->128 127->128 128->115 128->116 130->131
                                                  APIs
                                                  • NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00448780
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$F<:F$PH?O
                                                  • API String ID: 2949231068-3167603638
                                                  • Opcode ID: 82be1301322da52edae42780aeab9cb261b37734ac5377204158e0d7748629f7
                                                  • Instruction ID: b337df9181d93ec7e472769a86ebecf1f150ad31e4bd992b374346954fffac68
                                                  • Opcode Fuzzy Hash: 82be1301322da52edae42780aeab9cb261b37734ac5377204158e0d7748629f7
                                                  • Instruction Fuzzy Hash: FA029CB1D056688AFB208B14DC50BEAB7B5FF90304F1480EED94DA6241E7795EC68F16

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 140 448155-448166 141 448177-4481db 140->141 142 448168-448172 140->142 147 4481e2-4482a9 141->147 144 4483d7-448788 call 448431 call 448446 NtQueryDefaultLocale 142->144 175 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 144->175 176 44878e-4487e1 144->176 153 4482c3-4482d3 147->153 154 4482ab-4482c1 147->154 153->147 157 4482d9-4482ec 153->157 156 448326-44839b call 44839d 154->156 157->147 160 4482f2-448302 157->160 164 448304-44830e 160->164 165 448310 160->165 164->144 168 44831a-448320 164->168 165->168 168->156 209 448d2c-448ea7 call 448ea8 175->209 210 449639-449d4a 175->210 178 4487f2-4487fe 176->178 180 448826-448850 178->180 181 448800-448817 178->181 183 448853-4488de 180->183 184 448824 181->184 185 448819-448822 181->185 190 4488ef-4488fb 183->190 184->178 185->183 192 448923-44894d 190->192 193 4488fd-448914 190->193 192->175 195 448916-44891f 193->195 196 448921 193->196 195->175 196->190 222 449d50-449dd5 210->222 223 449f43-449fba call 449f55 210->223 227 449de6-449df2 222->227 233 449fcb-449ff1 223->233 229 449df4-449e0b 227->229 230 449e1a-449e44 227->230 231 449e0d-449e16 229->231 232 449e18 229->232 234 449e47-449ed1 230->234 231->234 232->227 239 449ff3-449ffc 233->239 240 449ffe 233->240 238 449ee2-449eee 234->238 241 449f16-449f40 238->241 242 449ef0-449f07 238->242 243 44a02b-44a101 call 44a042 call 44a059 239->243 240->243 244 449fbc-449fc5 240->244 245 449f14 242->245 246 449f09-449f12 242->246 255 44a107-44a113 243->255 244->233 245->238 246->223 256 44a2a0-44a2ef 255->256 257 44a119-44a17b 255->257 262 44a300 256->262 263 44a2f1-44a2fb 256->263 260 44a260-44a279 257->260 261 44a181-44a192 call 44a194 257->261 266 44a28c-44a295 260->266 267 44a27b-44a28a 260->267 265 44a4ba-44a4c1 262->265 263->265 270 44a4c3-44a4c9 265->270 271 44a4cf-45036c call 45035e call 45036d 265->271 268 44a29b 266->268 267->268 268->255 268->256 270->271
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$F<:F$PH?O
                                                  • API String ID: 2949231068-3167603638
                                                  • Opcode ID: 240acb076935a2823cfb178b6f4f592be2042494934c37bb267a48347a05cd05
                                                  • Instruction ID: 86409c28c6f4b232df55fe67af2a7da9cf52661d56c489b0acb440a414e820a8
                                                  • Opcode Fuzzy Hash: 240acb076935a2823cfb178b6f4f592be2042494934c37bb267a48347a05cd05
                                                  • Instruction Fuzzy Hash: CDF1AFB1D056688AFB208B14DC40BEAB7B5EF90304F1480FED84DA6281E77D5EC68F56

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 280 447b7f-447ba3 281 447bb5-447bf8 280->281 282 447ba5-447baf 280->282 285 447bfa-447c1d call 447c22 281->285 286 447c3b-447c99 281->286 282->281 283 44796b-4479cf call 4479db 282->283 293 448078-448093 call 448092 283->293 294 447cac-447cc1 286->294 295 447c9b-447ca7 286->295 298 447cd4-447cf3 294->298 299 447cc3-447ccf 294->299 297 447f9d-447fa4 295->297 297->293 303 447faa-448035 call 447fcc 297->303 301 447cf5-447d01 298->301 302 447d06-447d18 298->302 299->297 301->297 304 447d1a-447d26 302->304 305 447d2b-447d94 302->305 303->293 317 448037-448073 303->317 304->297 310 447f91-447f97 305->310 311 447d9a-447e06 305->311 310->297 314 447ea7-447eca call 447ec9 311->314 315 447e0c-447e1c 311->315 314->310 315->314 318 447e22-447e35 call 447e36 315->318 317->293 325 448777-448788 NtQueryDefaultLocale 317->325 318->314 326 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 325->326 327 44878e-4487e1 325->327 360 448d2c-448ea7 call 448ea8 326->360 361 449639-449d4a 326->361 329 4487f2-4487fe 327->329 331 448826-448850 329->331 332 448800-448817 329->332 334 448853-4488de 331->334 335 448824 332->335 336 448819-448822 332->336 341 4488ef-4488fb 334->341 335->329 336->334 343 448923-44894d 341->343 344 4488fd-448914 341->344 343->326 346 448916-44891f 344->346 347 448921 344->347 346->326 347->341 373 449d50-449dd5 361->373 374 449f43-449fba call 449f55 361->374 378 449de6-449df2 373->378 384 449fcb-449ff1 374->384 380 449df4-449e0b 378->380 381 449e1a-449e44 378->381 382 449e0d-449e16 380->382 383 449e18 380->383 385 449e47-449ed1 381->385 382->385 383->378 390 449ff3-449ffc 384->390 391 449ffe 384->391 389 449ee2-449eee 385->389 392 449f16-449f40 389->392 393 449ef0-449f07 389->393 394 44a02b-44a101 call 44a042 call 44a059 390->394 391->394 395 449fbc-449fc5 391->395 396 449f14 393->396 397 449f09-449f12 393->397 406 44a107-44a113 394->406 395->384 396->389 397->374 407 44a2a0-44a2ef 406->407 408 44a119-44a17b 406->408 413 44a300 407->413 414 44a2f1-44a2fb 407->414 411 44a260-44a279 408->411 412 44a181-44a192 call 44a194 408->412 417 44a28c-44a295 411->417 418 44a27b-44a28a 411->418 416 44a4ba-44a4c1 413->416 414->416 421 44a4c3-44a4c9 416->421 422 44a4cf-45036c call 45035e call 45036d 416->422 419 44a29b 417->419 418->419 419->406 419->407 421->422
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: ?C9:$PH?O
                                                  • API String ID: 0-401684170
                                                  • Opcode ID: e79fe60061e1cb5ef3c98facf097268d82a0c6d54ae1ab05b95d104faaa265bc
                                                  • Instruction ID: affe31e2c7e7db01b7a437fc7ed0e88104161d13aa18d9eabdfd8ccf298ce25f
                                                  • Opcode Fuzzy Hash: e79fe60061e1cb5ef3c98facf097268d82a0c6d54ae1ab05b95d104faaa265bc
                                                  • Instruction Fuzzy Hash: 3A329BB1D042688FFB24CB24DC40BEAB7B5EF90304F1441EAD949A7281E7795EC68F56

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 431 44f736-44f7cf 434 44f7d1-44f7e7 431->434 435 44f7e9-44f7f9 431->435 436 44f84c-44f853 434->436 437 44f7ff-44f812 435->437 438 44f708-44f735 call 44f736 435->438 441 44f895-44f8e1 436->441 442 44f855-44f893 call 44f86c 436->442 437->438 439 44f818-44f828 437->439 445 44f836 439->445 446 44f82a-44f834 439->446 443 44f8f3 441->443 444 44f8e3-44f8ed 441->444 451 44f8fd-44f98d 442->451 443->451 444->443 450 44f6a9-44f6bc call 44f6be 444->450 452 44f840-44f846 445->452 446->452 450->451 455 44f9a0-44f9b5 451->455 456 44f98f-44f99b 451->456 452->436 457 44f9b7-44f9c3 455->457 458 44f9c8-44f9e7 455->458 460 44fc91-44fcbc VirtualProtect 456->460 457->460 461 44f9e9-44f9f5 458->461 462 44f9fa-44fa0c 458->462 464 44fcfc-44fd02 460->464 465 44fcbe-44fcfa 460->465 461->460 466 44fa0e-44fa1a 462->466 467 44fa1f-44fa88 462->467 470 44fd08-44fd0f 464->470 465->470 466->460 473 44fc85-44fc8b 467->473 474 44fa8e-44fafa 467->474 471 44fd11-44fd43 470->471 472 44fd48-44fe47 call 44fe48 470->472 478 450291-45036c call 45035e call 45036d 471->478 472->478 473->460 480 44fb00-44fb10 474->480 481 44fb9b-44fbec call 44fbbd 474->481 480->481 483 44fb16-44fb2b call 44fb2c 480->483 497 44fbee-44fbf8 481->497 498 44fbfa-44fc51 481->498 483->481 501 44fc69-44fc70 497->501 499 44fc53-44fc5d 498->499 500 44fc5f 498->500 499->501 500->501 502 44fc80 501->502 503 44fc72-44fc7e 501->503 502->460 503->460
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID: 7=IK$M8@O
                                                  • API String ID: 544645111-1740675860
                                                  • Opcode ID: 3fdb0c2cdb371372913defeba832022f0f35c12ca29e0da8547959146942cbe6
                                                  • Instruction ID: a3861272b2befa98f87e64459467cdc224b4964880e1aed49ce1f55199c06b98
                                                  • Opcode Fuzzy Hash: 3fdb0c2cdb371372913defeba832022f0f35c12ca29e0da8547959146942cbe6
                                                  • Instruction Fuzzy Hash: 9A12DDB1C042688BEB248B14CC94BEABBB5EB41314F1481FAD84E67281D7395EC9CF56

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 504 447ec9-447ef8 505 447f06-447f5d 504->505 506 447efa-447f04 504->506 508 447f5f-447f69 505->508 509 447f6b 505->509 507 447f75-447f7c 506->507 510 447f8c 507->510 511 447f7e-447f8a 507->511 508->507 509->507 512 447f9d-447fa4 510->512 511->512 513 448078-448093 call 448092 512->513 514 447faa-448035 call 447fcc 512->514 514->513 521 448037-448073 514->521 521->513 524 448777-448788 NtQueryDefaultLocale 521->524 525 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 524->525 526 44878e-4487e1 524->526 559 448d2c-448ea7 call 448ea8 525->559 560 449639-449d4a 525->560 528 4487f2-4487fe 526->528 530 448826-448850 528->530 531 448800-448817 528->531 533 448853-4488de 530->533 534 448824 531->534 535 448819-448822 531->535 540 4488ef-4488fb 533->540 534->528 535->533 542 448923-44894d 540->542 543 4488fd-448914 540->543 542->525 545 448916-44891f 543->545 546 448921 543->546 545->525 546->540 572 449d50-449dd5 560->572 573 449f43-449fba call 449f55 560->573 577 449de6-449df2 572->577 583 449fcb-449ff1 573->583 579 449df4-449e0b 577->579 580 449e1a-449e44 577->580 581 449e0d-449e16 579->581 582 449e18 579->582 584 449e47-449ed1 580->584 581->584 582->577 589 449ff3-449ffc 583->589 590 449ffe 583->590 588 449ee2-449eee 584->588 591 449f16-449f40 588->591 592 449ef0-449f07 588->592 593 44a02b-44a101 call 44a042 call 44a059 589->593 590->593 594 449fbc-449fc5 590->594 595 449f14 592->595 596 449f09-449f12 592->596 605 44a107-44a113 593->605 594->583 595->588 596->573 606 44a2a0-44a2ef 605->606 607 44a119-44a17b 605->607 612 44a300 606->612 613 44a2f1-44a2fb 606->613 610 44a260-44a279 607->610 611 44a181-44a192 call 44a194 607->611 616 44a28c-44a295 610->616 617 44a27b-44a28a 610->617 615 44a4ba-44a4c1 612->615 613->615 620 44a4c3-44a4c9 615->620 621 44a4cf-45036c call 45035e call 45036d 615->621 618 44a29b 616->618 617->618 618->605 618->606 620->621
                                                  APIs
                                                  • NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00448780
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$PH?O
                                                  • API String ID: 2949231068-401684170
                                                  • Opcode ID: e1666de62be442a01cd41493e2c2e46bfc9ee9749563c69822e20682ff1ee9da
                                                  • Instruction ID: 4d49f0206b9bb48d5ab2a09ba080d56f24d65c9412d0e538a1a321ae6c3289af
                                                  • Opcode Fuzzy Hash: e1666de62be442a01cd41493e2c2e46bfc9ee9749563c69822e20682ff1ee9da
                                                  • Instruction Fuzzy Hash: D6D1EEB1D156588AFB208A14DC40BEAB7B5FF90314F1480FAD84DA7281E77D5EC68F26

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 630 447f20-447f5d 631 447f5f-447f69 630->631 632 447f6b 630->632 633 447f75-447f7c 631->633 632->633 634 447f8c 633->634 635 447f7e-447f8a 633->635 636 447f9d-447fa4 634->636 635->636 637 448078-448093 call 448092 636->637 638 447faa-448035 call 447fcc 636->638 638->637 645 448037-448073 638->645 645->637 648 448777-448788 NtQueryDefaultLocale 645->648 649 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 648->649 650 44878e-4487e1 648->650 683 448d2c-448ea7 call 448ea8 649->683 684 449639-449d4a 649->684 652 4487f2-4487fe 650->652 654 448826-448850 652->654 655 448800-448817 652->655 657 448853-4488de 654->657 658 448824 655->658 659 448819-448822 655->659 664 4488ef-4488fb 657->664 658->652 659->657 666 448923-44894d 664->666 667 4488fd-448914 664->667 666->649 669 448916-44891f 667->669 670 448921 667->670 669->649 670->664 696 449d50-449dd5 684->696 697 449f43-449fba call 449f55 684->697 701 449de6-449df2 696->701 707 449fcb-449ff1 697->707 703 449df4-449e0b 701->703 704 449e1a-449e44 701->704 705 449e0d-449e16 703->705 706 449e18 703->706 708 449e47-449ed1 704->708 705->708 706->701 713 449ff3-449ffc 707->713 714 449ffe 707->714 712 449ee2-449eee 708->712 715 449f16-449f40 712->715 716 449ef0-449f07 712->716 717 44a02b-44a101 call 44a042 call 44a059 713->717 714->717 718 449fbc-449fc5 714->718 719 449f14 716->719 720 449f09-449f12 716->720 729 44a107-44a113 717->729 718->707 719->712 720->697 730 44a2a0-44a2ef 729->730 731 44a119-44a17b 729->731 736 44a300 730->736 737 44a2f1-44a2fb 730->737 734 44a260-44a279 731->734 735 44a181-44a192 call 44a194 731->735 740 44a28c-44a295 734->740 741 44a27b-44a28a 734->741 739 44a4ba-44a4c1 736->739 737->739 744 44a4c3-44a4c9 739->744 745 44a4cf-45036c call 45035e call 45036d 739->745 742 44a29b 740->742 741->742 742->729 742->730 744->745
                                                  APIs
                                                  • NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00448780
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$PH?O
                                                  • API String ID: 2949231068-401684170
                                                  • Opcode ID: 40847282b27b532d950cb1f927c1674845177198330860eb1d5a2f15f1bbfed4
                                                  • Instruction ID: bb9ea77a753e24747e32f80f9fb63476c04ebb4a9506baa5f372c62c3ce404a9
                                                  • Opcode Fuzzy Hash: 40847282b27b532d950cb1f927c1674845177198330860eb1d5a2f15f1bbfed4
                                                  • Instruction Fuzzy Hash: AFC1FEB1D056588AFB208A14DC40BEAB7B5FF90314F1480FED84D97281E77D5EC68B26

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 754 4480ff-44810a 755 44810c-448116 754->755 756 44811b-448166 call 448155 754->756 757 4483d7-448788 call 448431 call 448446 NtQueryDefaultLocale 755->757 763 448177-4481db 756->763 764 448168-448172 756->764 793 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 757->793 794 44878e-4487e1 757->794 770 4481e2-4482a9 763->770 764->757 777 4482c3-4482d3 770->777 778 4482ab-4482c1 770->778 777->770 781 4482d9-4482ec 777->781 780 448326-44839b call 44839d 778->780 781->770 784 4482f2-448302 781->784 787 448304-44830e 784->787 788 448310 784->788 787->757 791 44831a-448320 787->791 788->791 791->780 828 448d2c-448ea7 call 448ea8 793->828 829 449639-449d4a 793->829 797 4487f2-4487fe 794->797 799 448826-448850 797->799 800 448800-448817 797->800 802 448853-4488de 799->802 803 448824 800->803 804 448819-448822 800->804 809 4488ef-4488fb 802->809 803->797 804->802 811 448923-44894d 809->811 812 4488fd-448914 809->812 811->793 814 448916-44891f 812->814 815 448921 812->815 814->793 815->809 841 449d50-449dd5 829->841 842 449f43-449fba call 449f55 829->842 846 449de6-449df2 841->846 852 449fcb-449ff1 842->852 848 449df4-449e0b 846->848 849 449e1a-449e44 846->849 850 449e0d-449e16 848->850 851 449e18 848->851 853 449e47-449ed1 849->853 850->853 851->846 858 449ff3-449ffc 852->858 859 449ffe 852->859 857 449ee2-449eee 853->857 860 449f16-449f40 857->860 861 449ef0-449f07 857->861 862 44a02b-44a101 call 44a042 call 44a059 858->862 859->862 863 449fbc-449fc5 859->863 864 449f14 861->864 865 449f09-449f12 861->865 874 44a107-44a113 862->874 863->852 864->857 865->842 875 44a2a0-44a2ef 874->875 876 44a119-44a17b 874->876 881 44a300 875->881 882 44a2f1-44a2fb 875->882 879 44a260-44a279 876->879 880 44a181-44a192 call 44a194 876->880 885 44a28c-44a295 879->885 886 44a27b-44a28a 879->886 884 44a4ba-44a4c1 881->884 882->884 889 44a4c3-44a4c9 884->889 890 44a4cf-45036c call 45035e call 45036d 884->890 887 44a29b 885->887 886->887 887->874 887->875 889->890
                                                  APIs
                                                  • NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00448780
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$PH?O
                                                  • API String ID: 2949231068-401684170
                                                  • Opcode ID: 4514d70b98babee4dcd6154e3761be038056c2e7cd1b8d0ada448dd5bcdf6368
                                                  • Instruction ID: 8219298c27be3c2337efd660c920e343fc145ca0f23e1a9d494d28013dbb016c
                                                  • Opcode Fuzzy Hash: 4514d70b98babee4dcd6154e3761be038056c2e7cd1b8d0ada448dd5bcdf6368
                                                  • Instruction Fuzzy Hash: 10D1CDB1D056688AF7208A14DC40BEEB7B5EF90314F1480FED84D96281EB7D5EC68F66

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 899 447fcc-448035 902 448037-448073 899->902 903 448078-448093 call 448092 899->903 902->903 908 448777-448788 NtQueryDefaultLocale 902->908 909 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 908->909 910 44878e-4487e1 908->910 943 448d2c-448ea7 call 448ea8 909->943 944 449639-449d4a 909->944 912 4487f2-4487fe 910->912 914 448826-448850 912->914 915 448800-448817 912->915 917 448853-4488de 914->917 918 448824 915->918 919 448819-448822 915->919 924 4488ef-4488fb 917->924 918->912 919->917 926 448923-44894d 924->926 927 4488fd-448914 924->927 926->909 929 448916-44891f 927->929 930 448921 927->930 929->909 930->924 956 449d50-449dd5 944->956 957 449f43-449fba call 449f55 944->957 961 449de6-449df2 956->961 967 449fcb-449ff1 957->967 963 449df4-449e0b 961->963 964 449e1a-449e44 961->964 965 449e0d-449e16 963->965 966 449e18 963->966 968 449e47-449ed1 964->968 965->968 966->961 973 449ff3-449ffc 967->973 974 449ffe 967->974 972 449ee2-449eee 968->972 975 449f16-449f40 972->975 976 449ef0-449f07 972->976 977 44a02b-44a101 call 44a042 call 44a059 973->977 974->977 978 449fbc-449fc5 974->978 979 449f14 976->979 980 449f09-449f12 976->980 989 44a107-44a113 977->989 978->967 979->972 980->957 990 44a2a0-44a2ef 989->990 991 44a119-44a17b 989->991 996 44a300 990->996 997 44a2f1-44a2fb 990->997 994 44a260-44a279 991->994 995 44a181-44a192 call 44a194 991->995 1000 44a28c-44a295 994->1000 1001 44a27b-44a28a 994->1001 999 44a4ba-44a4c1 996->999 997->999 1004 44a4c3-44a4c9 999->1004 1005 44a4cf-45036c call 45035e call 45036d 999->1005 1002 44a29b 1000->1002 1001->1002 1002->989 1002->990 1004->1005
                                                  APIs
                                                  • NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00448780
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$PH?O
                                                  • API String ID: 2949231068-401684170
                                                  • Opcode ID: 03be8c5fd2ac2b5ac22391ef65ed239e830d6f7c33d3728d7b38de355ee9e198
                                                  • Instruction ID: 4ee963b2bcc9cef1ffbbb69d50fa0bf6765ef81abf8979e503b9e43bd9e0f079
                                                  • Opcode Fuzzy Hash: 03be8c5fd2ac2b5ac22391ef65ed239e830d6f7c33d3728d7b38de355ee9e198
                                                  • Instruction Fuzzy Hash: 60C1FFB1D156588AF7208B24DC40BEAB7B5EF90304F1480FED84D97281EB7D5EC68B26

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1014 447c22-448788 NtQueryDefaultLocale 1016 448950-448d26 call 44897e call 44899c call 448a03 call 448cfe call 448d1b 1014->1016 1017 44878e-4487e1 1014->1017 1050 448d2c-448ea7 call 448ea8 1016->1050 1051 449639-449d4a 1016->1051 1019 4487f2-4487fe 1017->1019 1021 448826-448850 1019->1021 1022 448800-448817 1019->1022 1024 448853-4488de 1021->1024 1025 448824 1022->1025 1026 448819-448822 1022->1026 1031 4488ef-4488fb 1024->1031 1025->1019 1026->1024 1033 448923-44894d 1031->1033 1034 4488fd-448914 1031->1034 1033->1016 1036 448916-44891f 1034->1036 1037 448921 1034->1037 1036->1016 1037->1031 1063 449d50-449dd5 1051->1063 1064 449f43-449fba call 449f55 1051->1064 1068 449de6-449df2 1063->1068 1074 449fcb-449ff1 1064->1074 1070 449df4-449e0b 1068->1070 1071 449e1a-449e44 1068->1071 1072 449e0d-449e16 1070->1072 1073 449e18 1070->1073 1075 449e47-449ed1 1071->1075 1072->1075 1073->1068 1080 449ff3-449ffc 1074->1080 1081 449ffe 1074->1081 1079 449ee2-449eee 1075->1079 1082 449f16-449f40 1079->1082 1083 449ef0-449f07 1079->1083 1084 44a02b-44a101 call 44a042 call 44a059 1080->1084 1081->1084 1085 449fbc-449fc5 1081->1085 1086 449f14 1083->1086 1087 449f09-449f12 1083->1087 1096 44a107-44a113 1084->1096 1085->1074 1086->1079 1087->1064 1097 44a2a0-44a2ef 1096->1097 1098 44a119-44a17b 1096->1098 1103 44a300 1097->1103 1104 44a2f1-44a2fb 1097->1104 1101 44a260-44a279 1098->1101 1102 44a181-44a192 call 44a194 1098->1102 1107 44a28c-44a295 1101->1107 1108 44a27b-44a28a 1101->1108 1106 44a4ba-44a4c1 1103->1106 1104->1106 1111 44a4c3-44a4c9 1106->1111 1112 44a4cf-45036c call 45035e call 45036d 1106->1112 1109 44a29b 1107->1109 1108->1109 1109->1096 1109->1097 1111->1112
                                                  APIs
                                                  • NtQueryDefaultLocale.NTDLL(00000001,?), ref: 00448780
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DefaultLocaleQuery
                                                  • String ID: ?C9:$PH?O
                                                  • API String ID: 2949231068-401684170
                                                  • Opcode ID: 7234a087349d4a115844a7e055185a120b660d4e7ae671f24217fb5fc6af1e36
                                                  • Instruction ID: 040ac80de9dda1e4f57e250b0ec9a260025c23512ec1a695680aa6c9824bfbea
                                                  • Opcode Fuzzy Hash: 7234a087349d4a115844a7e055185a120b660d4e7ae671f24217fb5fc6af1e36
                                                  • Instruction Fuzzy Hash: BDA1CDB1D056688AFB208A14DC40BEAB7B5FF90304F1480FED84D96281E77D5EC68B66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: CPUIdleTime
                                                  • API String ID: 0-751903288
                                                  • Opcode ID: 5dbfadee54add6a4cd1cfd0c7856ea75c7b544fc507dd743d8ded343343257cc
                                                  • Instruction ID: 2e246cfacec29b3da170389f378b6fb92ba0f642e192783ac754f45fd605dc27
                                                  • Opcode Fuzzy Hash: 5dbfadee54add6a4cd1cfd0c7856ea75c7b544fc507dd743d8ded343343257cc
                                                  • Instruction Fuzzy Hash: B0E1EEB1D042689AFB248A15DC44BEB77B5FF44310F1480FAD84DA7680DA3D5EC58FA6

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1150 450a8f-450ac7 1151 450ad9-450b1c 1150->1151 1152 450ac9-450ad3 1150->1152 1156 450b5f-450bbd 1151->1156 1157 450b1e-450b5a 1151->1157 1152->1151 1153 45088f-4508e7 1152->1153 1155 4508ee-4509b5 1153->1155 1161 4509b7-4509cd 1155->1161 1162 4509cf-4509df 1155->1162 1163 450bd0-450be5 1156->1163 1164 450bbf-450bcb 1156->1164 1171 45169b-45169d ExitProcess 1157->1171 1166 450a32-450a39 1161->1166 1162->1155 1167 4509e5-4509f8 1162->1167 1169 450be7-450bf3 1163->1169 1170 450bf8-450c17 1163->1170 1168 450ec1-450ec8 1164->1168 1175 450a7b-450ac7 call 450a8f 1166->1175 1176 450a3b-450a5c call 450a5d 1166->1176 1167->1155 1174 4509fe-450a0e 1167->1174 1172 450f9c-45102e 1168->1172 1173 450ece-450f01 call 450edf call 450efc 1168->1173 1169->1168 1177 450c19-450c25 1170->1177 1178 450c2a-450c3c 1170->1178 1183 451030-45103a 1172->1183 1184 45103f-451064 call 451065 1172->1184 1173->1172 1181 450a10-450a1a 1174->1181 1182 450a1c 1174->1182 1175->1151 1175->1152 1176->1175 1177->1168 1186 450c4f-450cb8 1178->1186 1187 450c3e-450c4a 1178->1187 1190 450a26-450a2c 1181->1190 1182->1190 1191 4512fb-45138b call 45135c 1183->1191 1184->1191 1195 450eb5-450ebb 1186->1195 1196 450cbe-450d2a 1186->1196 1187->1168 1190->1166 1211 45138d-451399 1191->1211 1212 45139e-4513b3 1191->1212 1195->1168 1205 450d30-450d40 1196->1205 1206 450dcb-450e1c 1196->1206 1205->1206 1209 450d46-450d73 call 450d74 1205->1209 1214 450e1e-450e28 1206->1214 1215 450e2a-450e8d call 450e38 1206->1215 1209->1206 1218 45168f-451695 1211->1218 1216 4513b5-4513c1 1212->1216 1217 4513c6-4513e5 1212->1217 1220 450e99-450eae 1214->1220 1215->1220 1216->1218 1223 4513e7-4513f3 1217->1223 1224 4513f8-45140a 1217->1224 1218->1171 1220->1168 1223->1218 1227 45141d-451486 1224->1227 1228 45140c-451418 1224->1228 1232 451683-451689 1227->1232 1233 45148c-4514f8 1227->1233 1228->1218 1232->1218 1235 4514fe-45150e 1233->1235 1236 451599-4515ea 1233->1236 1235->1236 1237 451514-45152c call 45152d 1235->1237 1238 4515ec-4515f6 1236->1238 1239 4515f8-451622 call 45160a call 451620 1236->1239 1237->1236 1242 451667-45166e 1238->1242 1239->1242 1244 451670-45167c 1242->1244 1245 45167e 1242->1245 1244->1218 1245->1218
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: 53923869ae2d21a68422ecb97be07822389a94a0e8b5eafa7547efe3e0eb20fe
                                                  • Instruction ID: 07db722cc3d132f8554268fe53cf3232f264c6a24b7e7b28f31396832709a84e
                                                  • Opcode Fuzzy Hash: 53923869ae2d21a68422ecb97be07822389a94a0e8b5eafa7547efe3e0eb20fe
                                                  • Instruction Fuzzy Hash: 1BF1DCB5D002298FEB24CB14DC85BEAB775EB84315F1481FAD80D67281DA396ECACF51

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1249 450504-450523 1250 450525-45053b 1249->1250 1251 45053d-45054d 1249->1251 1252 4505a0-4505a7 1250->1252 1253 450553-450566 1251->1253 1254 45045c-450502 call 450504 1251->1254 1257 4505e9-450635 1252->1257 1258 4505a9-4505e7 1252->1258 1253->1254 1256 45056c-45057c 1253->1256 1262 450651-45068a 1254->1262 1260 45057e-450588 1256->1260 1261 45058a 1256->1261 1263 450647 1257->1263 1264 450637-450641 1257->1264 1258->1262 1268 450594-45059a 1260->1268 1261->1268 1266 450690-450816 1262->1266 1267 450f9c-45102e 1262->1267 1263->1262 1264->1263 1265 4503fd-450455 1264->1265 1265->1254 1269 450827-450865 call 450867 1266->1269 1270 450818-450822 1266->1270 1271 451030-45103a 1267->1271 1272 45103f-451064 call 451065 1267->1272 1268->1252 1275 450ae3-450b1c 1269->1275 1270->1275 1276 4512fb-45138b call 45135c 1271->1276 1272->1276 1279 450b5f-450bbd 1275->1279 1280 450b1e-450b5a 1275->1280 1296 45138d-451399 1276->1296 1297 45139e-4513b3 1276->1297 1288 450bd0-450be5 1279->1288 1289 450bbf-450bcb 1279->1289 1295 45169b-45169d ExitProcess 1280->1295 1293 450be7-450bf3 1288->1293 1294 450bf8-450c17 1288->1294 1292 450ec1-450ec8 1289->1292 1292->1267 1298 450ece-450f01 call 450edf call 450efc 1292->1298 1293->1292 1299 450c19-450c25 1294->1299 1300 450c2a-450c3c 1294->1300 1303 45168f-451695 1296->1303 1301 4513b5-4513c1 1297->1301 1302 4513c6-4513e5 1297->1302 1298->1267 1299->1292 1305 450c4f-450cb8 1300->1305 1306 450c3e-450c4a 1300->1306 1301->1303 1307 4513e7-4513f3 1302->1307 1308 4513f8-45140a 1302->1308 1303->1295 1311 450eb5-450ebb 1305->1311 1312 450cbe-450d2a 1305->1312 1306->1292 1307->1303 1313 45141d-451486 1308->1313 1314 45140c-451418 1308->1314 1311->1292 1319 450d30-450d40 1312->1319 1320 450dcb-450e1c 1312->1320 1321 451683-451689 1313->1321 1322 45148c-4514f8 1313->1322 1314->1303 1319->1320 1324 450d46-450d73 call 450d74 1319->1324 1328 450e1e-450e28 1320->1328 1329 450e2a-450e8d call 450e38 1320->1329 1321->1303 1330 4514fe-45150e 1322->1330 1331 451599-4515ea 1322->1331 1324->1320 1333 450e99-450eae 1328->1333 1329->1333 1330->1331 1334 451514-45152c call 45152d 1330->1334 1336 4515ec-4515f6 1331->1336 1337 4515f8-451622 call 45160a call 451620 1331->1337 1333->1292 1334->1331 1343 451667-45166e 1336->1343 1337->1343 1345 451670-45167c 1343->1345 1346 45167e 1343->1346 1345->1303 1346->1303
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: 617f80f199a127adc83e6a2e377c797e441d91f451c6546d552deda805f5e61a
                                                  • Instruction ID: 3f9a875d003b5238594a2d683857292776be9e9d0234b231c296ce08b23dab63
                                                  • Opcode Fuzzy Hash: 617f80f199a127adc83e6a2e377c797e441d91f451c6546d552deda805f5e61a
                                                  • Instruction Fuzzy Hash: 99E1F3B6D002699AE7248A24CC44BEBBB75EF80314F1440FAD90D67281E67D5FC5CFA6

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1352 44f17c-44f1be 1353 44f1c0-44f1cc 1352->1353 1354 44f1d1-44f1e6 1352->1354 1355 44f4c2-44f4c9 1353->1355 1356 44f1e8-44f1f4 1354->1356 1357 44f1f9-44f218 1354->1357 1360 44f59d-44f630 1355->1360 1361 44f4cf-44f55a 1355->1361 1356->1355 1358 44f21a-44f226 1357->1358 1359 44f22b-44f23d 1357->1359 1358->1355 1362 44f250-44f2b9 1359->1362 1363 44f23f-44f24b 1359->1363 1367 44f641-44f66d call 44f66e 1360->1367 1368 44f632-44f63c 1360->1368 1361->1360 1372 44f55c-44f598 call 44f57e 1361->1372 1369 44f4b6-44f4bc 1362->1369 1370 44f2bf-44f309 1362->1370 1363->1355 1373 44f8fd-44f98d 1367->1373 1368->1373 1369->1355 1374 44f31a-44f32b 1370->1374 1388 44fc9d-44fcbc VirtualProtect 1372->1388 1377 44f9a0-44f9b5 1373->1377 1378 44f98f-44f99b 1373->1378 1381 44f331-44f341 1374->1381 1382 44f3cc-44f3da call 44f3db 1374->1382 1379 44f9b7-44f9c3 1377->1379 1380 44f9c8-44f9e7 1377->1380 1384 44fc91-44fc97 1378->1384 1379->1384 1385 44f9e9-44f9f5 1380->1385 1386 44f9fa-44fa0c 1380->1386 1381->1382 1387 44f347-44f398 1381->1387 1382->1369 1384->1388 1385->1384 1393 44fa0e-44fa1a 1386->1393 1394 44fa1f-44fa88 1386->1394 1397 44f3be 1387->1397 1398 44f39a-44f3bc 1387->1398 1390 44fcfc-44fd02 1388->1390 1391 44fcbe-44fcfa 1388->1391 1400 44fd08-44fd0f 1390->1400 1391->1400 1393->1384 1405 44fc85-44fc8b 1394->1405 1406 44fa8e-44fafa 1394->1406 1397->1374 1398->1397 1403 44f3c5 1398->1403 1401 44fd11-44fd43 1400->1401 1402 44fd48-44fe47 call 44fe48 1400->1402 1410 450291-45036c call 45035e call 45036d 1401->1410 1402->1410 1403->1382 1405->1384 1412 44fb00-44fb10 1406->1412 1413 44fb9b-44fbec call 44fbbd 1406->1413 1412->1413 1415 44fb16-44fb2b call 44fb2c 1412->1415 1429 44fbee-44fbf8 1413->1429 1430 44fbfa-44fc51 1413->1430 1415->1413 1433 44fc69-44fc70 1429->1433 1431 44fc53-44fc5d 1430->1431 1432 44fc5f 1430->1432 1431->1433 1432->1433 1434 44fc80 1433->1434 1435 44fc72-44fc7e 1433->1435 1434->1384 1435->1384
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: ccb1ae3e866eaabb67bcb3e5bb4169633b3224eff27abbb1bb933b72e923b92b
                                                  • Instruction ID: c1c5a2b52ac2777b84dad6afc0ee10658096cb605b52f55d54c202d3ee8bb35f
                                                  • Opcode Fuzzy Hash: ccb1ae3e866eaabb67bcb3e5bb4169633b3224eff27abbb1bb933b72e923b92b
                                                  • Instruction Fuzzy Hash: E9E18EB1D046688BEB24CB14CC44BEBBBB5EB94305F1481FAD84D67341DA395EC98F91

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1436 45036d-450384 1437 450395-4503e0 1436->1437 1438 450386-450390 1436->1438 1440 4503f1-450502 call 450504 1437->1440 1441 4503e2-4503ec 1437->1441 1439 450651-45068a 1438->1439 1442 450690-450816 1439->1442 1443 450f9c-45102e 1439->1443 1440->1439 1441->1439 1445 450827-450865 call 450867 1442->1445 1446 450818-450822 1442->1446 1447 451030-45103a 1443->1447 1448 45103f-451064 call 451065 1443->1448 1451 450ae3-450b1c 1445->1451 1446->1451 1452 4512fb-45138b call 45135c 1447->1452 1448->1452 1457 450b5f-450bbd 1451->1457 1458 450b1e-450b5a 1451->1458 1475 45138d-451399 1452->1475 1476 45139e-4513b3 1452->1476 1467 450bd0-450be5 1457->1467 1468 450bbf-450bcb 1457->1468 1474 45169b-45169d ExitProcess 1458->1474 1472 450be7-450bf3 1467->1472 1473 450bf8-450c17 1467->1473 1471 450ec1-450ec8 1468->1471 1471->1443 1477 450ece-450f01 call 450edf call 450efc 1471->1477 1472->1471 1478 450c19-450c25 1473->1478 1479 450c2a-450c3c 1473->1479 1482 45168f-451695 1475->1482 1480 4513b5-4513c1 1476->1480 1481 4513c6-4513e5 1476->1481 1477->1443 1478->1471 1484 450c4f-450cb8 1479->1484 1485 450c3e-450c4a 1479->1485 1480->1482 1486 4513e7-4513f3 1481->1486 1487 4513f8-45140a 1481->1487 1482->1474 1490 450eb5-450ebb 1484->1490 1491 450cbe-450d2a 1484->1491 1485->1471 1486->1482 1492 45141d-451486 1487->1492 1493 45140c-451418 1487->1493 1490->1471 1498 450d30-450d40 1491->1498 1499 450dcb-450e1c 1491->1499 1500 451683-451689 1492->1500 1501 45148c-4514f8 1492->1501 1493->1482 1498->1499 1503 450d46-450d73 call 450d74 1498->1503 1507 450e1e-450e28 1499->1507 1508 450e2a-450e8d call 450e38 1499->1508 1500->1482 1509 4514fe-45150e 1501->1509 1510 451599-4515ea 1501->1510 1503->1499 1512 450e99-450eae 1507->1512 1508->1512 1509->1510 1513 451514-45152c call 45152d 1509->1513 1515 4515ec-4515f6 1510->1515 1516 4515f8-451622 call 45160a call 451620 1510->1516 1512->1471 1513->1510 1522 451667-45166e 1515->1522 1516->1522 1524 451670-45167c 1522->1524 1525 45167e 1522->1525 1524->1482 1525->1482
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: e7bea1cb912ead99b3c68215314b3e07fdbf91b41c8a4a80c553f1831929f496
                                                  • Instruction ID: 7d83b62a4b3c460f08f3ee3ecc95c67276056b7f956874cfa80b4b4c34286971
                                                  • Opcode Fuzzy Hash: e7bea1cb912ead99b3c68215314b3e07fdbf91b41c8a4a80c553f1831929f496
                                                  • Instruction Fuzzy Hash: F191C3A2E056698AF7208A25CC047EBBB75EF95304F1440FAD90C97281D67D4FC58F56
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 2c464d5e201ebe36540b62079788eea77ddcece536ab7cfcde83af830e6b3c3c
                                                  • Instruction ID: e4e27b68b9d8dae53e300c711356dc54588a72b09e812089ed3deed55c6b4113
                                                  • Opcode Fuzzy Hash: 2c464d5e201ebe36540b62079788eea77ddcece536ab7cfcde83af830e6b3c3c
                                                  • Instruction Fuzzy Hash: 2071DFB2D142149FE7248B20DC91BEA7775FF88300F1481FAD50AA6681E679AEC1CF55
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 92801131a7ec75ac782a6b9e43aa3a96c292a06568674952349255d6dc0049ae
                                                  • Instruction ID: ecd361dc35052532853e54a6926c4829c1e00efd1f15860a5ae2cba1960f13ef
                                                  • Opcode Fuzzy Hash: 92801131a7ec75ac782a6b9e43aa3a96c292a06568674952349255d6dc0049ae
                                                  • Instruction Fuzzy Hash: 4A5146B6D042149BEB248B24DC44BEBB779EF88310F1451BAE80DA7200E67D5EC6CB52
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4a90a95a8b77a10eb62f3e3aac7b2df2c485b1205bc7f667646d33f52379d16a
                                                  • Instruction ID: 39b11b1434357f005c52c4b06ac5cc6dd20f4fda03771ff1495b9d6e2cf0347c
                                                  • Opcode Fuzzy Hash: 4a90a95a8b77a10eb62f3e3aac7b2df2c485b1205bc7f667646d33f52379d16a
                                                  • Instruction Fuzzy Hash: 8C51E5F2D082156FF7148A20DC95BEB7778EB85310F1540BED50E96281EA7CAFC18B52

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1121 45135c-45138b 1122 45138d-451399 1121->1122 1123 45139e-4513b3 1121->1123 1126 45168f-45169d ExitProcess 1122->1126 1124 4513b5-4513c1 1123->1124 1125 4513c6-4513e5 1123->1125 1124->1126 1127 4513e7-4513f3 1125->1127 1128 4513f8-45140a 1125->1128 1127->1126 1130 45141d-451486 1128->1130 1131 45140c-451418 1128->1131 1133 451683-451689 1130->1133 1134 45148c-4514f8 1130->1134 1131->1126 1133->1126 1136 4514fe-45150e 1134->1136 1137 451599-4515ea 1134->1137 1136->1137 1138 451514-45152c call 45152d 1136->1138 1139 4515ec-4515f6 1137->1139 1140 4515f8-451622 call 45160a call 451620 1137->1140 1138->1137 1143 451667-45166e 1139->1143 1140->1143 1145 451670-45167c 1143->1145 1146 45167e 1143->1146 1145->1126 1146->1126
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-399585960
                                                  • Opcode ID: 9987b74b35b7efefe7e0fd5fbcc275b66f5bf9efc88b590431aab326eb7f637d
                                                  • Instruction ID: 657dd7b5b7baf5439849a3b4e450714379c83ffae1f11fed192ca67ae9905425
                                                  • Opcode Fuzzy Hash: 9987b74b35b7efefe7e0fd5fbcc275b66f5bf9efc88b590431aab326eb7f637d
                                                  • Instruction Fuzzy Hash: BB6118B4E012289FEB24CF04D880BA9B7B6FB85305F1481EAD90D67352D735AE95CF85

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1531 44f3fa-44f41d 1532 44f41f-44f429 1531->1532 1533 44f42b-44f482 1531->1533 1534 44f49a-44f4a1 1532->1534 1535 44f484-44f48e 1533->1535 1536 44f490 1533->1536 1537 44f4b1 1534->1537 1538 44f4a3-44f4af 1534->1538 1535->1534 1536->1534 1539 44f4c2-44f4c9 1537->1539 1538->1539 1540 44f59d-44f630 1539->1540 1541 44f4cf-44f55a 1539->1541 1544 44f641-44f66d call 44f66e 1540->1544 1545 44f632-44f63c 1540->1545 1541->1540 1547 44f55c-44f598 call 44f57e 1541->1547 1548 44f8fd-44f98d 1544->1548 1545->1548 1559 44fc9d-44fcbc VirtualProtect 1547->1559 1551 44f9a0-44f9b5 1548->1551 1552 44f98f-44f99b 1548->1552 1553 44f9b7-44f9c3 1551->1553 1554 44f9c8-44f9e7 1551->1554 1556 44fc91-44fc97 1552->1556 1553->1556 1557 44f9e9-44f9f5 1554->1557 1558 44f9fa-44fa0c 1554->1558 1556->1559 1557->1556 1562 44fa0e-44fa1a 1558->1562 1563 44fa1f-44fa88 1558->1563 1560 44fcfc-44fd02 1559->1560 1561 44fcbe-44fcfa 1559->1561 1566 44fd08-44fd0f 1560->1566 1561->1566 1562->1556 1569 44fc85-44fc8b 1563->1569 1570 44fa8e-44fafa 1563->1570 1567 44fd11-44fd43 1566->1567 1568 44fd48-44fe47 call 44fe48 1566->1568 1574 450291-45036c call 45035e call 45036d 1567->1574 1568->1574 1569->1556 1576 44fb00-44fb10 1570->1576 1577 44fb9b-44fbec call 44fbbd 1570->1577 1576->1577 1579 44fb16-44fb2b call 44fb2c 1576->1579 1593 44fbee-44fbf8 1577->1593 1594 44fbfa-44fc51 1577->1594 1579->1577 1597 44fc69-44fc70 1593->1597 1595 44fc53-44fc5d 1594->1595 1596 44fc5f 1594->1596 1595->1597 1596->1597 1598 44fc80 1597->1598 1599 44fc72-44fc7e 1597->1599 1598->1556 1599->1556
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 661178d8d39ac36de5de7a499e032ae78e556922e1dba19d090e8acbca8962a3
                                                  • Instruction ID: 6ce37ece8f39aea0e3e9849bef63ec9f654ad2ce67012c509587255cc16d64f5
                                                  • Opcode Fuzzy Hash: 661178d8d39ac36de5de7a499e032ae78e556922e1dba19d090e8acbca8962a3
                                                  • Instruction Fuzzy Hash: 667139B2D046649AF720CA14DC44BEB7BB5EB91314F0480FAD84D66281DA7D5FC98FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: 1a9ca2c46801d86c2a290121eee24b0696460330103a97a8e81fa7293e15ea26
                                                  • Instruction ID: 5fa6e7a2149ef7774b65e016255f4b370a0c3361cc31efd3b603e377a5cbf0cf
                                                  • Opcode Fuzzy Hash: 1a9ca2c46801d86c2a290121eee24b0696460330103a97a8e81fa7293e15ea26
                                                  • Instruction Fuzzy Hash: FD7101B1D051298BE7248B24CE45BFBB779EF84311F0041FAE80DA6691EA385FC5CE56
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: a1ca237e1ee230e529fac5db30e3b5826f3109b05387a35561b886d5449e81ff
                                                  • Instruction ID: ab18b4a39965711012370fdbc74fab8c3a6404a7f2e9bcdf0150818117e1522d
                                                  • Opcode Fuzzy Hash: a1ca237e1ee230e529fac5db30e3b5826f3109b05387a35561b886d5449e81ff
                                                  • Instruction Fuzzy Hash: F761D2B5D402298AEB248B10DC80BFEB775EB80315F1480FAD80D56681E67D5ECADF26
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ea5c1c053b764f0de573c5aec223d2a2817054c864163747f88326e5ae08c054
                                                  • Instruction ID: 2862c1b7dc4156bab3b09c60c421d08879023e6f8ccaf7ca7ce299cede969719
                                                  • Opcode Fuzzy Hash: ea5c1c053b764f0de573c5aec223d2a2817054c864163747f88326e5ae08c054
                                                  • Instruction Fuzzy Hash: 9E71B7B1D045A88BFB21CA14CC94BEB7BB5EF82305F1480FAD84D66642C53D5EC98F96
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 0bf8cd525ce72662a4f6bbbf42183663af6dccab2ca1b36a18eecc7551784e3d
                                                  • Instruction ID: b5462a7dc32233ea19ec90c66b60ad5d081333d210f61d3a7dc6e8f7a4422032
                                                  • Opcode Fuzzy Hash: 0bf8cd525ce72662a4f6bbbf42183663af6dccab2ca1b36a18eecc7551784e3d
                                                  • Instruction Fuzzy Hash: 995134B2D042149EEB248B20DC40BEBB779EF98310F1551FAE80DA7240E67D5EC68B52
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 095d847d6210cd4d9e6b72e39ad5cd187352c3d781bc50744aea72c85bffd37c
                                                  • Instruction ID: 44ac3e25ad072e250b786e0cae7f82ea8a838a0f56462193e3406910ed56adf9
                                                  • Opcode Fuzzy Hash: 095d847d6210cd4d9e6b72e39ad5cd187352c3d781bc50744aea72c85bffd37c
                                                  • Instruction Fuzzy Hash: 995134B2D04624AAEB248B11DC44BFBB775FF98310F1451FAE80DA6240E67D5EC2CB52
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: c82a7e8c272cfb0333689ecbaca40127da1bb029545d977cf3595452bfcc8910
                                                  • Instruction ID: c084e6389d98af4c78ad39703024382ab0ecacf433a830abfa59a9f4b69fbee5
                                                  • Opcode Fuzzy Hash: c82a7e8c272cfb0333689ecbaca40127da1bb029545d977cf3595452bfcc8910
                                                  • Instruction Fuzzy Hash: D351C5B2D042689EF7248A14DC44BEB7BA8EB51314F0480FADD4D66241DA7D5FC98FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 10c4bd6d0fb5a71dd5f7cbde8a795953a7674b1eded08a0512d7a47695fb5113
                                                  • Instruction ID: 006886a2074139031c4dae4f9876cb976f80420ed1dd609a76f01c87d3f97c39
                                                  • Opcode Fuzzy Hash: 10c4bd6d0fb5a71dd5f7cbde8a795953a7674b1eded08a0512d7a47695fb5113
                                                  • Instruction Fuzzy Hash: 225134B6D042549EEB248B20DC40BEBB779FF98310F1441FAE80DA7240E67D5EC68B52
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 42d2355282d5839ee2f60e322a3087765fba9cfff587d10c89f48af0aa77cb59
                                                  • Instruction ID: c75fd3fa9dbd434e43f45e7cacf3d32b957b86d098777a366486c040a5c72f13
                                                  • Opcode Fuzzy Hash: 42d2355282d5839ee2f60e322a3087765fba9cfff587d10c89f48af0aa77cb59
                                                  • Instruction Fuzzy Hash: EE51D6B2C046689FF7248614DC44BE77BA8EB55310F0480FADD4D66281DA7D5FC98FA2
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 9f83e7d716fae92d76dc3d9d0b11e4b680b2afeb1972dba3be290bdbf5c680a0
                                                  • Instruction ID: c47c66899612d2b959af4b1c392667a969700ecc4660610565e05a98f4952d2c
                                                  • Opcode Fuzzy Hash: 9f83e7d716fae92d76dc3d9d0b11e4b680b2afeb1972dba3be290bdbf5c680a0
                                                  • Instruction Fuzzy Hash: A851E9B1C086688AFB20C614DC94BEB7BB4EB41315F1480FAC88D66281C67D5FC98F92
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: d4eff2db383368c6f2782e11276349faec453ccef38bfa0d5c9cf577b89a284a
                                                  • Instruction ID: 028964ab0eee376156a41260e7eb5f5351192e450af746e1845a316b152e14fc
                                                  • Opcode Fuzzy Hash: d4eff2db383368c6f2782e11276349faec453ccef38bfa0d5c9cf577b89a284a
                                                  • Instruction Fuzzy Hash: 3341E3B6D011246FF7248A24DD49BEB7B78EB44311F0101FBED0D66281D6795FC58EA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: ee5e072b0555f6409ab9176000e2281ad54836660236f45cc9f5677c7a7c6099
                                                  • Instruction ID: a7fba7d9001d524f3d98df4b288a368db5e8c06c2b05571ea00c67c3f0706df9
                                                  • Opcode Fuzzy Hash: ee5e072b0555f6409ab9176000e2281ad54836660236f45cc9f5677c7a7c6099
                                                  • Instruction Fuzzy Hash: 053146B2C081946FF7248B20CC55BE77778EB84300F1411FEE509A6241D6BDAEC28BA6
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 277aed4a515f0861096751b51f8c0950680b4af80c8a7ab6ed72660bb0235ca8
                                                  • Instruction ID: 97f000f54153bd1f3e52b3c22b37879ad52bf852cf3720f0c55abeba2fc351e1
                                                  • Opcode Fuzzy Hash: 277aed4a515f0861096751b51f8c0950680b4af80c8a7ab6ed72660bb0235ca8
                                                  • Instruction Fuzzy Hash: 1E41B9B2D086A89EF7508615DC48BD77BA4AB11314F0480FADC8D26281DA7D5FC98FE2
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00001BDC), ref: 0044FCB4
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 9d181b8693067e05d31687bc78c1b7c5d4e70b34f568984ae1aca460f4c6b5b0
                                                  • Instruction ID: d6f0c2adaea9c69e6c562fd6eeb18a76a5f3f452e773e8f7a36a4790a59592b9
                                                  • Opcode Fuzzy Hash: 9d181b8693067e05d31687bc78c1b7c5d4e70b34f568984ae1aca460f4c6b5b0
                                                  • Instruction Fuzzy Hash: E641B7A2C086A89AF7508614DC44BD77BA4AB11314F0484FADC8D66281CA7D5FCD8FE2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 4c61a5be459a62c96c459e05ca6703045492ab72b96aa38a82b6b6cd499ee301
                                                  • Instruction ID: 15341fa6ed387a5cbc8ce39c0dfdb6a7e57a3392352f8c27fd8ad9b86f0842ad
                                                  • Opcode Fuzzy Hash: 4c61a5be459a62c96c459e05ca6703045492ab72b96aa38a82b6b6cd499ee301
                                                  • Instruction Fuzzy Hash: 10312BF2D04154ABF7208A24DC55BE7B778FB84310F1510BFE80EA6241D57DAEC68AA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 4575d347407fe720908f731d7c8c595ea5fefe74c8e4858c94f238a6a6b0dbdf
                                                  • Instruction ID: 478f660d06ec4f402fae47039d6452991c11e1f35e67b25ffa2a01061a243081
                                                  • Opcode Fuzzy Hash: 4575d347407fe720908f731d7c8c595ea5fefe74c8e4858c94f238a6a6b0dbdf
                                                  • Instruction Fuzzy Hash: B43107F2D08155AFF7248B20DC65BFB7774EB89314F1410EED50AA6241D678AFC18E51
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: bf82f0cde0b7f1a5513dcfa9082128970a17736288ac3c844db51f0226bba75b
                                                  • Instruction ID: bf8ea235be3a5e4be7d4bba7e13b715128ce72a7182ded9bb56c8a80ae7195a4
                                                  • Opcode Fuzzy Hash: bf82f0cde0b7f1a5513dcfa9082128970a17736288ac3c844db51f0226bba75b
                                                  • Instruction Fuzzy Hash: 70215AF2C041546FF7208A20DC55BE77778EB84310F1410BFE40EA6241D5BE9EC68BA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 0d654fcd288ba6738b1f3b33cfc4f66ac59a363202fd90bda7f57986079b5baa
                                                  • Instruction ID: cb3084be0fb6882134a6e335c199642cba12d1880cd68c7a44cd1653770a3ddc
                                                  • Opcode Fuzzy Hash: 0d654fcd288ba6738b1f3b33cfc4f66ac59a363202fd90bda7f57986079b5baa
                                                  • Instruction Fuzzy Hash: 2631F5F2D08154AFE7288A20DC65BBB7774EB89314F1410EED50A66241D679AFC18E52
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 752576830de920583ea354a5c190c4195da986c92de977e83d52ea485141741f
                                                  • Instruction ID: 9c73f48c9abb337def73c951bc0d804db831e2027c949e096c569391d6525b2c
                                                  • Opcode Fuzzy Hash: 752576830de920583ea354a5c190c4195da986c92de977e83d52ea485141741f
                                                  • Instruction Fuzzy Hash: 0C3104F2D08154AFF7248B20DC65BEB7774EB89314F1410EED50AA6381D679AFC18E52
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 5f5ee827523f26e4a05426eb216ec4a1da4c0bd2de2f9bcbf79ec62fd7689b21
                                                  • Instruction ID: 9e3ec06713deb07c11fd454cb8d50870a7c176dfba3832126dba4b224b5b0676
                                                  • Opcode Fuzzy Hash: 5f5ee827523f26e4a05426eb216ec4a1da4c0bd2de2f9bcbf79ec62fd7689b21
                                                  • Instruction Fuzzy Hash: 1D2138F2D041546FF7144624DC59FE77778EB85310F1510BBE90EA6140D5BEAEC28BA2
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 55ce109c35b17708194960d93333637ef56e9adf3dfdf08067143e56cbea61c1
                                                  • Instruction ID: af69618d3aa26887dbea5ae0166ff16069fd70c5c485f47cfe736e61806d75e4
                                                  • Opcode Fuzzy Hash: 55ce109c35b17708194960d93333637ef56e9adf3dfdf08067143e56cbea61c1
                                                  • Instruction Fuzzy Hash: 3E31F0B2D041689BEB248B21DC94BEBBBB4AB89310F1451EAD50E67241D67D5EC1CF81
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 21339e469c7794a67d1ff86f5279343039c94051bcfddf903868522bf08bc731
                                                  • Instruction ID: 86428c316a61849d8a02023680fb3ad400a4b4aab87e7fd6976caea2da8a8f52
                                                  • Opcode Fuzzy Hash: 21339e469c7794a67d1ff86f5279343039c94051bcfddf903868522bf08bc731
                                                  • Instruction Fuzzy Hash: 573124F2D08154AFF7248B20DC65BEB7774EB89304F1410EED10AA6281D678AFC18E52
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: cc78cab86e11d6938e0885892d3fe135ea76f1874bb94d7e203018b521bea1c1
                                                  • Instruction ID: 0b6af650dd75ea6613e50ae0bc5cf0e9900f2c6ed38773477e1a4499071ff37b
                                                  • Opcode Fuzzy Hash: cc78cab86e11d6938e0885892d3fe135ea76f1874bb94d7e203018b521bea1c1
                                                  • Instruction Fuzzy Hash: C3216DF2D041516FF7108A20DC54BE777B8EB84310F1550BBD50EA6180D1BD9EC28BA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a78c41ff6fe8455ef131d4d3954ffe6f9878c9f8d514da749e7a507ae7e7c5aa
                                                  • Instruction ID: 431b4bcfe0a8b5a9ddaa492a97366024d233f39abf51cb7d2cf2fb5a6badc4cb
                                                  • Opcode Fuzzy Hash: a78c41ff6fe8455ef131d4d3954ffe6f9878c9f8d514da749e7a507ae7e7c5aa
                                                  • Instruction Fuzzy Hash: CF31A2709055689FEB20CA14CC947FEB775AFC2307F1480EBDC4A56252D6385E898F86
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: c6926a5416a49bada8a1ac329aab1673f30fe352371c57eda2891cdf52d2555b
                                                  • Instruction ID: 3ba08f3beeb5cad99def57d04667dd99ccbac5cac399ac7d5568ada592433284
                                                  • Opcode Fuzzy Hash: c6926a5416a49bada8a1ac329aab1673f30fe352371c57eda2891cdf52d2555b
                                                  • Instruction Fuzzy Hash: 4011E4B1D051249FF7288A14DD1ABEB7774EB01311F0100FAE90D26292D6795EC88E92
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 7dd44adfa0d5a1614aac1df84b116d1e56400f1f9655717a2a6a15acd1603039
                                                  • Instruction ID: f2ccc94abe6c6c3b7b368ef90ea4231ad99967fd17189077d81c9383f937d46d
                                                  • Opcode Fuzzy Hash: 7dd44adfa0d5a1614aac1df84b116d1e56400f1f9655717a2a6a15acd1603039
                                                  • Instruction Fuzzy Hash: 411170B2D152599FEB248B20CC65BEAB7B4FB49300F1511EDD10AA6280D7796FC08F41
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: f8df85392510c863405ee99aecf05cfd916d353f0d154713152ac697fc0db5e6
                                                  • Instruction ID: 19568197fca101edaa5c890f726681d4f1d0e316b1042decd0eb9b9c14032283
                                                  • Opcode Fuzzy Hash: f8df85392510c863405ee99aecf05cfd916d353f0d154713152ac697fc0db5e6
                                                  • Instruction Fuzzy Hash: 2B01A7F2E081416BF7544A20DC15FF777A8EB49300F1910AEE54AE6240D57DAEC14B52
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 08bba1731b2e21ac5344977a4242cb07191d5e13af79a5594b212fd17d30a074
                                                  • Instruction ID: d1014095859d5b0a74c1eaf52d76848a1c845828e3af49294490fdadc1764980
                                                  • Opcode Fuzzy Hash: 08bba1731b2e21ac5344977a4242cb07191d5e13af79a5594b212fd17d30a074
                                                  • Instruction Fuzzy Hash: 330147B2D092446BF7248B20CC61BEB77B8EB45300F1910EEE10AE6180D67DDEC18B12
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 82f6071b97edc1f44e93cc38a549e235ea483e91d99fb4a410f4145c93685948
                                                  • Instruction ID: a13df4b819736906b0e8126ced755ee24d134b4784554269f79447eb0c656e6f
                                                  • Opcode Fuzzy Hash: 82f6071b97edc1f44e93cc38a549e235ea483e91d99fb4a410f4145c93685948
                                                  • Instruction Fuzzy Hash: 86012BB2E082416BF7154B30DC15BE777B8EB95300F1910FED10AA6180D57D9EC14F11
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 76a31b4987dac53150b78685924038611e732db40cd588da06cbe998e228a725
                                                  • Instruction ID: 4375966182c1e6de7fa93b25dbb70c17781218a3ce205e63a652feb93dd889a6
                                                  • Opcode Fuzzy Hash: 76a31b4987dac53150b78685924038611e732db40cd588da06cbe998e228a725
                                                  • Instruction Fuzzy Hash: 9601A7B2E081416BF7554A34DC15BE777B8AB59300F1911BE920AA6280D57DAEC14B52
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 26e2f0eea32f4f92c947d73e49e537a92f17a7fcd1cc39ca75650481f02b98cc
                                                  • Instruction ID: f457e3ca925209706ee592eb6b78a91d51dac56dff97090351442c57b1f5d709
                                                  • Opcode Fuzzy Hash: 26e2f0eea32f4f92c947d73e49e537a92f17a7fcd1cc39ca75650481f02b98cc
                                                  • Instruction Fuzzy Hash: D501D4F2D15246ABF7248B20CC25BEA7774FB89300F0510EDD20AA2280D67CAEC08F51
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: d169312bc8f2fe66a8feb7b45ef52848d942fc5259de0b4e606ba5851f04fd9d
                                                  • Instruction ID: c7e9fcd0e9441a3d67cb0c0edbe2a04bbf54f8aeab99ae2fea54a8626a29b5a8
                                                  • Opcode Fuzzy Hash: d169312bc8f2fe66a8feb7b45ef52848d942fc5259de0b4e606ba5851f04fd9d
                                                  • Instruction Fuzzy Hash: F901D4F2D04246ABF7248B20CC25BEA77B4FB49300F0510EDE20AA2240D67CAEC08F51
                                                  APIs
                                                  • VirtualProtect.KERNELBASE(?,?,00000040,-00000C6F,?,?,?,00413D71,?,?,?,?,?,00439770,?,?), ref: 00439C9E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProtectVirtual
                                                  • String ID:
                                                  • API String ID: 544645111-0
                                                  • Opcode ID: 39361320b1ad2c2aad4103cdd6b975ae73e9fc5c66a3e67a3245180b9b1c83f0
                                                  • Instruction ID: 20658876cd606456cee8080e30dc987481c0ba5ab99358ce534ae09142cea47e
                                                  • Opcode Fuzzy Hash: 39361320b1ad2c2aad4103cdd6b975ae73e9fc5c66a3e67a3245180b9b1c83f0
                                                  • Instruction Fuzzy Hash: F601D4F2D04246ABF7248B20CC25BEA7774FB89300F1511EDD20AA2240D67CAEC18F51
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: 1b2e10797166e5cb8629abffdde026c31985aa090b6698ba61f7bbd82796b3ad
                                                  • Instruction ID: cfa6b83f7e6f5969a2b685a93fed4c00b834ca7abdf4138fe8f591017ba9b503
                                                  • Opcode Fuzzy Hash: 1b2e10797166e5cb8629abffdde026c31985aa090b6698ba61f7bbd82796b3ad
                                                  • Instruction Fuzzy Hash: 44F046E7D001245EF7008624EC09BEA6A3697C0302F1981BBCD0D236C6A5BD5FCA4E93
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: 0bd8600776bf760cbb42e3548d7d7618d17cd9d90919e7ad5f8d96232640c461
                                                  • Instruction ID: 94ca76f2f8b3ed0795f5f8f67a2d7629606dfddd1cc2232346f90ba4f8e8dab1
                                                  • Opcode Fuzzy Hash: 0bd8600776bf760cbb42e3548d7d7618d17cd9d90919e7ad5f8d96232640c461
                                                  • Instruction Fuzzy Hash: 4FF049B090522DCFEB30CB15CC457ACB7B0BB05306F1441EAC86E66691C7344EC98F46
                                                  APIs
                                                  • ExitProcess.KERNEL32(00000000), ref: 0045169D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExitProcess
                                                  • String ID:
                                                  • API String ID: 621844428-0
                                                  • Opcode ID: 7f56710c7fa7f8844b8837eae7774a04ea3f0a03e6f4b6ae52f36a1ac756d3dd
                                                  • Instruction ID: 7da459f2d35826cc67fcc461d9fcd525de8673f361ff4db3d2f4f26a4fc7c110
                                                  • Opcode Fuzzy Hash: 7f56710c7fa7f8844b8837eae7774a04ea3f0a03e6f4b6ae52f36a1ac756d3dd
                                                  • Instruction Fuzzy Hash: 87C08CE18482445BF3089700EC8A7682238A700312F2800AAE94E541C1C63C0FCA0D06
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: D$D$E$H$I$I$I$L$L$N$R$R$R$T$T$V$W$a$a$a$a$a$a$a$a$a$a$b$c$d$d$e$e$e$e$e$e$g$g$g$i$i$l$l$l$m$m$m$n$o$o$o$o$r$r$r$r$r$r$t$t$t$t$t$t$v$y$y$y
                                                  • API String ID: 0-33356354
                                                  • Opcode ID: 9123273cefadbd93079facfb838c5680298f2edb7c13564b10737b63499b7f47
                                                  • Instruction ID: 3623022d9db6cf98a934223f59d7d2014a6ec6544d75cb8e834b714ef0229a6e
                                                  • Opcode Fuzzy Hash: 9123273cefadbd93079facfb838c5680298f2edb7c13564b10737b63499b7f47
                                                  • Instruction Fuzzy Hash: 71B14251D096E8C9FB21C624DC447DABEA15F52708F0841E9C58C6A283D7BF0FD9CB66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: C$R$R$S$S$U$U$U$a$a$c$c$c$d$d$e$e$e$e$e$g$g$i$i$i$i$l$l$n$n$n$n$o$o$p$r$r$r$s$t$t$t$t$t
                                                  • API String ID: 0-1493201413
                                                  • Opcode ID: 55d9be71481be7de8b3096c8be780363d91bb0c03f4c22e511da7d427341f51d
                                                  • Instruction ID: fefc15fe2e0aa14fa1ea78af81fe8a883ca28c4ed93f70dc6213afc62d0af518
                                                  • Opcode Fuzzy Hash: 55d9be71481be7de8b3096c8be780363d91bb0c03f4c22e511da7d427341f51d
                                                  • Instruction Fuzzy Hash: BDA1B561D086E889F7218628DC187DABEB19F55308F0440F9D54C6B682D7BE0FD5CB66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: -BootTimeDefrag$-InstallNative$-NewInstallNative$-UninstallNative$8<$DiskDefrag$Foucs_Color$Frame_Color$Mid_Back_Color$SeBackupPrivilege$SeRestorePrivilege$Select_Color$Text_Color$Window$chs
                                                  • API String ID: 0-2221245366
                                                  • Opcode ID: 8dc74c9718cc92380e0816ff2a7d5b163d56ba6fdf62a592c148a30059151318
                                                  • Instruction ID: 25248643ca3250cfc3ef4025252237aa734a8ea8c17f33746b0f5633289900ae
                                                  • Opcode Fuzzy Hash: 8dc74c9718cc92380e0816ff2a7d5b163d56ba6fdf62a592c148a30059151318
                                                  • Instruction Fuzzy Hash: 26B1C970644340ABD320EB61DC86FAF77A8AF84704F10492EF54992281DBBDE5588B6F
                                                  APIs
                                                  • GetMenuItemInfoW.USER32(00000000,00000000,00000001), ref: 0041FAF6
                                                  • GetMenuItemInfoW.USER32(00000000,00000001,00000001,?), ref: 0041FB49
                                                  • GetMenuItemInfoW.USER32(00000000,00000002,00000001,?), ref: 0041FB9C
                                                  • GetSubMenu.USER32(00000000,00000000), ref: 0041FBC3
                                                  • GetSubMenu.USER32(00000000,00000001), ref: 0041FD14
                                                  • GetSubMenu.USER32(?,00000000), ref: 0041FD7A
                                                  • GetSubMenu.USER32(00000000,00000002), ref: 0041FE06
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Menu$InfoItem
                                                  • String ID: $0$3401008$3401009$3401010$3401011$3401012$3401013$3401014$3401015$3401016$3401017$3401018$3401019$3401020$3401021$3401022$3401024$3401098$3401131
                                                  • API String ID: 1040333723-179025603
                                                  • Opcode ID: 57bab4f1923334ec470cd56f5efcc3a9a6a283e0eb4f594bc954c30004842149
                                                  • Instruction ID: 83c1616b1d25a5f5e88f9c25e0e2a21432fc20987b46dd7eda8cdac89d290607
                                                  • Opcode Fuzzy Hash: 57bab4f1923334ec470cd56f5efcc3a9a6a283e0eb4f594bc954c30004842149
                                                  • Instruction Fuzzy Hash: F7811FF0FA031036E794AAA59C53FEB31686F44B44F20C81F760EB25D5C9ACA84556ED
                                                  APIs
                                                  • OpenSCManagerW.ADVAPI32(00000000,00000000,20000000,?,00000000,?,?,00427EC2,B7F9C0F2), ref: 0041B4C2
                                                  • OpenServiceW.ADVAPI32(00000000,VSS,00000034,?,?,00000000,?,?,00427EC2,B7F9C0F2), ref: 0041B4DD
                                                  • CloseServiceHandle.ADVAPI32(00000000,?,00000000,?,?,00427EC2,B7F9C0F2), ref: 0041B4EA
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: OpenService$CloseHandleManager
                                                  • String ID: VSS
                                                  • API String ID: 4136619037-4102325705
                                                  • Opcode ID: a669f043333560b65fa7305655f79df43c8048374914dc36b6d5132fd2da2c07
                                                  • Instruction ID: e3fabb29cb39525be17c5613465a7dd84fffe719b6809a75a20e2f83d6b45fa7
                                                  • Opcode Fuzzy Hash: a669f043333560b65fa7305655f79df43c8048374914dc36b6d5132fd2da2c07
                                                  • Instruction Fuzzy Hash: 6631E932601314A7D610EBA8AC80FFB775DEB45365F84083FF904D2251DB19E98987EA
                                                  APIs
                                                  • FindFirstFileW.KERNEL32(?,?,?,00000000,0000024C), ref: 004112A2
                                                  • GetPrivateProfileStringW.KERNEL32(main,DefragTime,0047D9D0,?,00000064,?), ref: 0041134A
                                                  • GetPrivateProfileStringW.KERNEL32(main,TotalDefraggedFileSize,0047EF74,?,00000064,?), ref: 004113FA
                                                  • StrFormatByteSizeW.SHLWAPI(00000000), ref: 0041141C
                                                  • GetPrivateProfileStringW.KERNEL32(main,DefraggedFileCount,0047EF74,?,00000064,?), ref: 00411452
                                                  • FindNextFileW.KERNEL32(?,00000010), ref: 00411474
                                                  • FindClose.KERNEL32(?), ref: 00411483
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: FindPrivateProfileString$File$ByteCloseFirstFormatNextSize
                                                  • String ID: 3401068$3401069$3401070$DefragTime$DefraggedFileCount$DG$LG$TotalDefraggedFileSize$`=$main
                                                  • API String ID: 295610168-2526466113
                                                  • Opcode ID: d1cd0ec7a8fdc8ff7367d6e0728dff8a46181e4d412615e5ddc93afe06c8e850
                                                  • Instruction ID: 3dc56caefaff00a374a3ee75e2b4c31a72c5442d79c66a3b7d7afc40f3bd3104
                                                  • Opcode Fuzzy Hash: d1cd0ec7a8fdc8ff7367d6e0728dff8a46181e4d412615e5ddc93afe06c8e850
                                                  • Instruction Fuzzy Hash: 6691A771244340AFD320DF21CC46FAB77E8AF88B14F108A2EF65DA71D1DAB56944CB5A
                                                  APIs
                                                  • GetPrivateProfileStringW.KERNEL32(main,DefragTime,0047D9D0,?,00000064,?), ref: 0041134A
                                                  • GetPrivateProfileStringW.KERNEL32(main,TotalDefraggedFileSize,0047EF74,?,00000064,?), ref: 004113FA
                                                  • StrFormatByteSizeW.SHLWAPI(00000000), ref: 0041141C
                                                  • GetPrivateProfileStringW.KERNEL32(main,DefraggedFileCount,0047EF74,?,00000064,?), ref: 00411452
                                                  • FindNextFileW.KERNEL32(?,00000010), ref: 00411474
                                                  • FindClose.KERNEL32(?), ref: 00411483
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: PrivateProfileString$Find$ByteCloseFileFormatNextSize
                                                  • String ID: DefragTime$DefraggedFileCount$LG$TotalDefraggedFileSize$`=$main
                                                  • API String ID: 2174522762-3670384684
                                                  • Opcode ID: 637e9459b825226f02b753a8a6ecd317c3f6f5394dd561357564af9cc347cd40
                                                  • Instruction ID: faa287cb98b21d4df2f3e2fa49730f9b90f221f68114e230af78a147129465c0
                                                  • Opcode Fuzzy Hash: 637e9459b825226f02b753a8a6ecd317c3f6f5394dd561357564af9cc347cd40
                                                  • Instruction Fuzzy Hash: 82516271204341AFE324DB21CD45FAF77E8AB88B04F10891EF64D972D1DA74A945CB6A
                                                  APIs
                                                  • GetPrivateProfileStringW.KERNEL32(main,DefragTime,0047D9D0,?,00000064,?), ref: 0041134A
                                                  • GetPrivateProfileStringW.KERNEL32(main,TotalDefraggedFileSize,0047EF74,?,00000064,?), ref: 004113FA
                                                  • StrFormatByteSizeW.SHLWAPI(00000000), ref: 0041141C
                                                  • GetPrivateProfileStringW.KERNEL32(main,DefraggedFileCount,0047EF74,?,00000064,?), ref: 00411452
                                                  • FindNextFileW.KERNEL32(?,00000010), ref: 00411474
                                                  • FindClose.KERNEL32(?), ref: 00411483
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: PrivateProfileString$Find$ByteCloseFileFormatNextSize
                                                  • String ID: DefragTime$DefraggedFileCount$LG$TotalDefraggedFileSize$`=$main
                                                  • API String ID: 2174522762-3670384684
                                                  • Opcode ID: 32f377f5775842a14210629ecb5cba280cca974c36c24aed09cdb2c69e2afdbd
                                                  • Instruction ID: 01dd7cb33c618876df907d584398aa6540e784f12a7d1eb18dd06df18f62a64b
                                                  • Opcode Fuzzy Hash: 32f377f5775842a14210629ecb5cba280cca974c36c24aed09cdb2c69e2afdbd
                                                  • Instruction Fuzzy Hash: BB516171204341AFE324DB21CD45FAF77E8AB88B04F10891EF54D972D1DA74A945CB6A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Z$E$E8??$P$[P$c$e$i$o$r$r7P$s$s$t$x
                                                  • API String ID: 0-3767325802
                                                  • Opcode ID: 7b44de917e0946fa85af6044ff051f99ed61c6d0cedfc67b4feb00d9795caf1d
                                                  • Instruction ID: 1702e38a3bee028d3e0293ac0a65c8106e752dcdcd82b226944de6aee223d544
                                                  • Opcode Fuzzy Hash: 7b44de917e0946fa85af6044ff051f99ed61c6d0cedfc67b4feb00d9795caf1d
                                                  • Instruction Fuzzy Hash: DCD1AAB2D08254AAF7208A24DC14BFB7B79EF85310F1881FED44D97680D63D5BC28B66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: EIJ@$L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-3433997057
                                                  • Opcode ID: 15764802d7d7b0d4f27bfe2ef9311148e416cdae23c94716772f19f99440e6d3
                                                  • Instruction ID: 55d4a9da1893ff10dbc9c663ac3346e7b6afcc6c9885c8ea4cea76d6d5d4ae49
                                                  • Opcode Fuzzy Hash: 15764802d7d7b0d4f27bfe2ef9311148e416cdae23c94716772f19f99440e6d3
                                                  • Instruction Fuzzy Hash: 4322BDB1D056289FF7248B14DC84BEAB7B5EB84310F1481FAD80DA6380DA799FC18F56
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 474J$L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-2225504134
                                                  • Opcode ID: 818498461cd6009afff92374aeb762906e6a53dd4976c27593ce2b4dc6e9fead
                                                  • Instruction ID: 2870ebdbdfc728ee8acd89f6ed051f062dc889e88341798e9980337cccd3f322
                                                  • Opcode Fuzzy Hash: 818498461cd6009afff92374aeb762906e6a53dd4976c27593ce2b4dc6e9fead
                                                  • Instruction Fuzzy Hash: 81F100B1D042599AF7248A24DC44BEBB7B5EF84310F0481FAD40DA7780DA7D5EC58F66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: EIJ@$L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-3433997057
                                                  • Opcode ID: 2fa6d6e31f51ea156e5e23b9ca74401a7c4c61ba169654f71f6344e1f28bc70e
                                                  • Instruction ID: 3803c2b04a44ebe43ea66454f75ff9c4cb087bc36747ba395b20881ba7ab3b27
                                                  • Opcode Fuzzy Hash: 2fa6d6e31f51ea156e5e23b9ca74401a7c4c61ba169654f71f6344e1f28bc70e
                                                  • Instruction Fuzzy Hash: F9A103B1D446599BF7208A24DC44BEBBA79EB91310F0480FAE40DA7780DA7D5FC58F52
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 09d16a3bb0f4609a549d56198bceb779bfd6e8bcb389cb16a13675f608c824c9
                                                  • Instruction ID: 82f18518bb93426235d9fe337fad5d5f0958d9af0aa7e1f6aad47fe6e1ae5069
                                                  • Opcode Fuzzy Hash: 09d16a3bb0f4609a549d56198bceb779bfd6e8bcb389cb16a13675f608c824c9
                                                  • Instruction Fuzzy Hash: AB42B461D086E48AFB21C628DC447DAAA76DF65304F0840F9D58CAB281D6BF1FD5CB26
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: d5a33e0f623b5d37f2a7e7060de638840631511f8737e3f4a723caf9370581ce
                                                  • Instruction ID: c2e646bf7d6ca0273beebdd51e89b7347aab6de5eed3d60b30a10b3d3e968603
                                                  • Opcode Fuzzy Hash: d5a33e0f623b5d37f2a7e7060de638840631511f8737e3f4a723caf9370581ce
                                                  • Instruction Fuzzy Hash: 2E228BB1D046689BFB24CA14DC94BEAB7B5FB84304F1481FAD80DA7380DA795EC28F55
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: e8532ee7123fccdc141d5036cc0a23ea92ad14211c4dba913da86a3fdf53da84
                                                  • Instruction ID: d79fccdd94043bc8b05df2627ea50a6c95460a82c4597cd9a677a97389c79295
                                                  • Opcode Fuzzy Hash: e8532ee7123fccdc141d5036cc0a23ea92ad14211c4dba913da86a3fdf53da84
                                                  • Instruction Fuzzy Hash: C922B661D086E4CAFB21C624DC447DAAA759F65304F0840E9D18CAB282D6BF1FD5CF67
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: e44105d52112ee748f1a67f3e5ad0c94b5fa0f4e5f8982de8b15c93d94c173e7
                                                  • Instruction ID: 3f1a04f0cbe776255debb4c0f641b7e57a6397e02cd92f1bd07b92c44ae8138f
                                                  • Opcode Fuzzy Hash: e44105d52112ee748f1a67f3e5ad0c94b5fa0f4e5f8982de8b15c93d94c173e7
                                                  • Instruction Fuzzy Hash: 1212A561D086E4CAFB21C624DC447DAAA769F65304F0840E9D18CAB282D6BF1FD5CF67
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 6d280be28a2e54f72cefa738e8ddd89bf69d8c226daf637f02a1ef8f61d224d2
                                                  • Instruction ID: b1841e3eaf7a3eb688d848a10c7e6010faf37bac45bbdfb6b88af22982bcf7dd
                                                  • Opcode Fuzzy Hash: 6d280be28a2e54f72cefa738e8ddd89bf69d8c226daf637f02a1ef8f61d224d2
                                                  • Instruction Fuzzy Hash: 5012C461D086E48AFB218624DC447DAAA75EF65304F0840F9D18CAB282D6BF1FD5CF67
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 518879235d4c8f78c2f4eb094706895d68d65b23b7a638f96347f96dfad16338
                                                  • Instruction ID: d5e76136c4effb3996fc699b8d731241d514287b10d89288596918f277233384
                                                  • Opcode Fuzzy Hash: 518879235d4c8f78c2f4eb094706895d68d65b23b7a638f96347f96dfad16338
                                                  • Instruction Fuzzy Hash: D912B361D086E48AFB218624DC447DAAA75EF65304F0840F9D18CAB382D6BF1FD5CF66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: bbeecedf93143fabc093fd8a157d62c3b78c4328392170c782768398d6b02c9a
                                                  • Instruction ID: fdabbe045074b5573506d2182deca5439f2c36dd62c53b4500587d1a998372fa
                                                  • Opcode Fuzzy Hash: bbeecedf93143fabc093fd8a157d62c3b78c4328392170c782768398d6b02c9a
                                                  • Instruction Fuzzy Hash: B1F1D2A1D186A48AFB208624DC447DAAA75EF65304F0850F9D48CAB381D6BF0FD5CF66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 93930d630e8a26037718b1f92f23739e9e02da470476c2f6c6ab651144df44b7
                                                  • Instruction ID: 16e6b98e3974592eec16effec08712fc926bba0ccd199af44c9dac6798116048
                                                  • Opcode Fuzzy Hash: 93930d630e8a26037718b1f92f23739e9e02da470476c2f6c6ab651144df44b7
                                                  • Instruction Fuzzy Hash: EBF1D3A1D186A48AFB208624DC447DAAA75EF65304F0840FDD58CAB381D6BF0FD5CF66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: d722e569cb8a96ca315a6b569cb8ea6e4f54657b58ae96b07238d7ac6e1e0f56
                                                  • Instruction ID: f35c07d98c52e09d0e532c9aa2dd671539c5361e4c78a99440c75e4cd68b8f9d
                                                  • Opcode Fuzzy Hash: d722e569cb8a96ca315a6b569cb8ea6e4f54657b58ae96b07238d7ac6e1e0f56
                                                  • Instruction Fuzzy Hash: 10D1D3B1D046689AF7248B25DC44BEB77B5EB90310F1480FAD40DA6380EA7D5FC58F66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: f2cdc47ea1deee255579ab9c6580fefa7cd8d2a15f9152b9e8788b81d0eae746
                                                  • Instruction ID: 474798ddfeeb9d09ea9dbe8387f1447da7dd7b526b39564a34415ebe7920fdaa
                                                  • Opcode Fuzzy Hash: f2cdc47ea1deee255579ab9c6580fefa7cd8d2a15f9152b9e8788b81d0eae746
                                                  • Instruction Fuzzy Hash: 84D1DFB2D046689AF7248A24DC44BEAB775EB90310F1480FAD50DA7380EA7D5FC58F56
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 5b6d25f602aeae7d124ac8ae51d67eb4b5b87918d6c446653e55fb08efa6cf48
                                                  • Instruction ID: 80fb4cbb4548571e63f884ec82f473023b959de98703fadcd9bc206f49eaebe5
                                                  • Opcode Fuzzy Hash: 5b6d25f602aeae7d124ac8ae51d67eb4b5b87918d6c446653e55fb08efa6cf48
                                                  • Instruction Fuzzy Hash: 1CC1F5B2D146649AF7248A25DC44BEBB6B5EF90310F0480FAD40DA7380EA7D5FC58F66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 8b3a52fa99f391410a71d112db949da09e1690dc4c7cb6b82604e6523881aaf4
                                                  • Instruction ID: 6f446f239948cc8b5632a34995ca79f86b5c18690bbe64e35d15e2fa174d8980
                                                  • Opcode Fuzzy Hash: 8b3a52fa99f391410a71d112db949da09e1690dc4c7cb6b82604e6523881aaf4
                                                  • Instruction Fuzzy Hash: 8DD1B0A1D18298CAFB208624DC447EAA675EF65304F0890FDD14DAB381E67F0FD5CB26
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 62a87f15dab65f0b0f630af46665d2a0b2e9725ea0042692ccee828af4d7f1e9
                                                  • Instruction ID: 53b596fa4bd3642ce1447842a70456616d4abc87991a4682d362a0c588771cee
                                                  • Opcode Fuzzy Hash: 62a87f15dab65f0b0f630af46665d2a0b2e9725ea0042692ccee828af4d7f1e9
                                                  • Instruction Fuzzy Hash: D7B1E1B1D002659AFB248B25DC44BFAB6B5EF91310F1480FAD40DA7680EA7D5FC18F66
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 763979b861c1899a7e53399005ae075353ee11ec3a58d359bbcac24711a73671
                                                  • Instruction ID: 9ed466247bb3ea18d1886f174313768fbeba31dd07ea00e56588439ed852ab42
                                                  • Opcode Fuzzy Hash: 763979b861c1899a7e53399005ae075353ee11ec3a58d359bbcac24711a73671
                                                  • Instruction Fuzzy Hash: 3CB1D0B1E046689BF7248A24DC44BEB7BB5EB91300F1480FAD40DA7280DA7D5FC28F56
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: L$L$W$a$a$b$d$i$o$r$r$y
                                                  • API String ID: 0-4069139063
                                                  • Opcode ID: 2bcba6365e0cd40e94e0875866ec244990429a507e08a418ee7dd19bb02d4e72
                                                  • Instruction ID: 038611ed5b504ced05b8c0be29d281cf78b28e76f8d33e38198bd1245a1842bd
                                                  • Opcode Fuzzy Hash: 2bcba6365e0cd40e94e0875866ec244990429a507e08a418ee7dd19bb02d4e72
                                                  • Instruction Fuzzy Hash: BFB115B2D046689AF7208A25DC44BEBBA79EB91310F0480FAD40D67780DA7D5FC58F66
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,?,?,00421955), ref: 00419D9A
                                                  • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,00421955), ref: 00419DA1
                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00419DB7
                                                  • CloseHandle.KERNEL32(?,?,?,?,?,?,?,00421955), ref: 00419DC6
                                                  • AdjustTokenPrivileges.ADVAPI32 ref: 00419E04
                                                  • CloseHandle.KERNEL32(00000000), ref: 00419E13
                                                  • CloseHandle.KERNEL32(00000000), ref: 00419E24
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
                                                  • String ID: SeShutdownPrivilege
                                                  • API String ID: 1280518032-3733053543
                                                  • Opcode ID: da0e7d1861009587fb01dbe4e0b9d2093fea7a0ac8dcd4d1a170a0e53db07ebf
                                                  • Instruction ID: d07024e087d9fbb4da489035f39631b0ffcbbc48e9dced30be6a628d6d85d024
                                                  • Opcode Fuzzy Hash: da0e7d1861009587fb01dbe4e0b9d2093fea7a0ac8dcd4d1a170a0e53db07ebf
                                                  • Instruction Fuzzy Hash: D91130B5208300ABD314DFA4DC89B5B77E4BB88B00F80882CF54DC6290E778D8C48B5A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: $>
                                                  • API String ID: 0-4162622711
                                                  • Opcode ID: 92d9eede98623f53117d376c72bc09aac5265e67f7db331a73714669efe9eeb3
                                                  • Instruction ID: ab613082dd5abe8ce957bb114a2766d0e8ed38c9df93d9e2be8208bb24206897
                                                  • Opcode Fuzzy Hash: 92d9eede98623f53117d376c72bc09aac5265e67f7db331a73714669efe9eeb3
                                                  • Instruction Fuzzy Hash: 5432C1705087419BC339DF24C950BEBB7E5FF99300F04492EE99A872A0E7789945CB5B
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000028,?,?,?,?,?,00421972), ref: 0041E100
                                                  • OpenProcessToken.ADVAPI32(00000000,?,?,?,00421972), ref: 0041E107
                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0041E124
                                                  • AdjustTokenPrivileges.ADVAPI32 ref: 0041E148
                                                  • GetLastError.KERNEL32 ref: 0041E14E
                                                  • ExitWindowsEx.USER32(00000001,80020003), ref: 0041E16E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
                                                  • String ID: SeShutdownPrivilege
                                                  • API String ID: 107509674-3733053543
                                                  • Opcode ID: b491cb2bc98087b98b93889b4cab252affd35304ae06bf2e3e34bcfb05d76a30
                                                  • Instruction ID: ff8bdaaac48f1339d689247c0ac3bb4d0c15d19762690cb1fcb66aa4c131ddab
                                                  • Opcode Fuzzy Hash: b491cb2bc98087b98b93889b4cab252affd35304ae06bf2e3e34bcfb05d76a30
                                                  • Instruction Fuzzy Hash: 7301FC35644310BFE3109BA8DC49B9B7698BB44B04F40482DFD4DE6191D77499408BDA
                                                  APIs
                                                  • GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,?,?), ref: 0045A8C2
                                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 0045A915
                                                  • FindFirstFileW.KERNEL32(?,?,?,?,?), ref: 0045A955
                                                  • FindClose.KERNEL32(00000000,?,00000000,00000000,00000001,?,?,?), ref: 0045A9AA
                                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,00000000,00000000,?,?,?), ref: 0045A9CE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DiskFreeSpace$Find$CloseFileFirst
                                                  • String ID: %c:\
                                                  • API String ID: 281833627-3142399695
                                                  • Opcode ID: 451e843c757d912e0df44721ece3a0365b6d60f66d903087e08b2b682d24d5dc
                                                  • Instruction ID: 5c1349d2b4a299dbbed6192556f5b370b8187b703f81d55d5c722b9a40b8fb44
                                                  • Opcode Fuzzy Hash: 451e843c757d912e0df44721ece3a0365b6d60f66d903087e08b2b682d24d5dc
                                                  • Instruction Fuzzy Hash: A071FBB55057019FD314DF64D988BABB7E4FF98711F008A2EE89A87390E734A848CF56
                                                  APIs
                                                  • IsIconic.USER32(?), ref: 0041F916
                                                  • SendMessageW.USER32(?,00000027,?,00000000), ref: 0041F937
                                                  • GetSystemMetrics.USER32(0000000B), ref: 0041F945
                                                  • GetSystemMetrics.USER32(0000000C), ref: 0041F94B
                                                  • GetClientRect.USER32(?,?), ref: 0041F958
                                                  • DrawIcon.USER32(?,?,?,?), ref: 0041F989
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MetricsSystem$ClientDrawIconIconicMessageRectSend
                                                  • String ID:
                                                  • API String ID: 2166663075-0
                                                  • Opcode ID: cb24d554b556fdc8d671f57bd367dd0002cc258e733202bd551999ba64437650
                                                  • Instruction ID: c07e6ffc6c3a7e6482c06200d306031f545548e1037b46c62c472d77c4aae73d
                                                  • Opcode Fuzzy Hash: cb24d554b556fdc8d671f57bd367dd0002cc258e733202bd551999ba64437650
                                                  • Instruction Fuzzy Hash: AE3158712086019FD324DF38C989BABB7E8FB88710F144A2EE19A93290DB74E845CB55
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00020028,?,?,?,?,?,?,?,0041A0B9,SeBackupPrivilege), ref: 00419CFD
                                                  • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,0041A0B9,SeBackupPrivilege), ref: 00419D04
                                                  • LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00419D1E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Process$CurrentLookupOpenPrivilegeTokenValue
                                                  • String ID:
                                                  • API String ID: 3639550587-0
                                                  • Opcode ID: 7148b218a58efe162156a67a36f4013a52d7ca8231e1dbe32e75ae0325f5605e
                                                  • Instruction ID: f3d016862a4d3342d6fd7035e13c423cea38e9027ddeccfb2464269e0ea5178e
                                                  • Opcode Fuzzy Hash: 7148b218a58efe162156a67a36f4013a52d7ca8231e1dbe32e75ae0325f5605e
                                                  • Instruction Fuzzy Hash: 73015275644301AFE314CFA5DC89B6BB7E8FB88B05F80492CF54DC2290E774D9848B56
                                                  APIs
                                                  • FindFirstFileW.KERNEL32(?,00000003,?), ref: 0046326C
                                                  • FindNextFileW.KERNEL32(?,00000003,?), ref: 00463410
                                                  • FindClose.KERNEL32(?), ref: 0046342D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Find$File$CloseFirstNext
                                                  • String ID: %s%s\$%s*
                                                  • API String ID: 3541575487-790581550
                                                  • Opcode ID: 299fa53831f00350431557c8593a3fc536372945f534859870c8437012aa5de1
                                                  • Instruction ID: c3493345b0c0ceefe68b50463acd725d1f8c1e028979316797af0ed8e7acec35
                                                  • Opcode Fuzzy Hash: 299fa53831f00350431557c8593a3fc536372945f534859870c8437012aa5de1
                                                  • Instruction Fuzzy Hash: BC71B5711083809FC720EF64C884A6BB7E5FB89314F444A6EF85997391E734EA45CB57
                                                  APIs
                                                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 0045619C
                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 004561B2
                                                  • GetTickCount.KERNEL32 ref: 004561D8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Time$FileSystem$CountTick
                                                  • String ID: `=
                                                  • API String ID: 4225568743-2762138152
                                                  • Opcode ID: a2be66a8711fb6042d050ad9d72f7f1aa4f7f8a456ccd17a4fe35b8af1094bf9
                                                  • Instruction ID: cb7797f1e122fad48ce01ee4d6f3ba629bf9ae48cbace117fb0e68904283f0d7
                                                  • Opcode Fuzzy Hash: a2be66a8711fb6042d050ad9d72f7f1aa4f7f8a456ccd17a4fe35b8af1094bf9
                                                  • Instruction Fuzzy Hash: CB61E8B1A04B06AFC308DF6AC481696FBE5FF48714F80461EE96983351DB34B554CF99
                                                  APIs
                                                  • LoadLibraryW.KERNEL32(PowrProf.dll,00000001,?,0042198D,00000002), ref: 0041E189
                                                  • GetProcAddress.KERNEL32(00000000,SetSuspendState), ref: 0041E19B
                                                  • FreeLibrary.KERNEL32(00000000), ref: 0041E1B7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Library$AddressFreeLoadProc
                                                  • String ID: PowrProf.dll$SetSuspendState
                                                  • API String ID: 145871493-1420736420
                                                  • Opcode ID: cc42e22b2c3cdccf1d52a58f3ef6048082fefe304da44aace1865287b01325bc
                                                  • Instruction ID: 1295b46436a6d6ef84abe92a3e8f017b2096165fdcf3e5832b2fc3faa33b59df
                                                  • Opcode Fuzzy Hash: cc42e22b2c3cdccf1d52a58f3ef6048082fefe304da44aace1865287b01325bc
                                                  • Instruction Fuzzy Hash: E2E04F357012606B527117366C48D9F2A68DFC1B91349467EF819D1294DF38C9828AAA
                                                  APIs
                                                  • IsDebuggerPresent.KERNEL32 ref: 00473B49
                                                  • SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00473B5E
                                                  • UnhandledExceptionFilter.KERNEL32(0047CF54), ref: 00473B69
                                                  • GetCurrentProcess.KERNEL32(C0000409), ref: 00473B85
                                                  • TerminateProcess.KERNEL32(00000000), ref: 00473B8C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
                                                  • String ID:
                                                  • API String ID: 2579439406-0
                                                  • Opcode ID: 5ae23ef8c9597736f524d82b530ad1912cf66df142059fb024dfe3cae4b4f3e6
                                                  • Instruction ID: 5fbb9a2fc2dc4524adccc28e56c0de5744acadb4307870d4d3e04b8eaaabc2f4
                                                  • Opcode Fuzzy Hash: 5ae23ef8c9597736f524d82b530ad1912cf66df142059fb024dfe3cae4b4f3e6
                                                  • Instruction Fuzzy Hash: E421E3B8828204DFC700DFA5FC856853BA4FB28329F5040BBE80D87762E77466848F5D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 8$IE86$n$n$x
                                                  • API String ID: 0-1284800677
                                                  • Opcode ID: 49f6c7d491df1318932873179aea70be49b4781967e1b6ac7e96827784a4547d
                                                  • Instruction ID: 6bdb9857468e5045a603d32b13271e17733e50a8e9c1ac8a6b70d987db33c79c
                                                  • Opcode Fuzzy Hash: 49f6c7d491df1318932873179aea70be49b4781967e1b6ac7e96827784a4547d
                                                  • Instruction Fuzzy Hash: ACA103B2D042158FE728CF24CD89AEABBB5EBD5304F0581FFD0096A285D7795B85CE41
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 8$IE86$n$n$x
                                                  • API String ID: 0-1284800677
                                                  • Opcode ID: 955f9bbf62d644edee5a9b3affc0cb77196ea0747bd876138b64d54d3c734627
                                                  • Instruction ID: 20fe90df3e22339c27c343d5e76b007449b16cc7dedec2529d32559a082b8349
                                                  • Opcode Fuzzy Hash: 955f9bbf62d644edee5a9b3affc0cb77196ea0747bd876138b64d54d3c734627
                                                  • Instruction Fuzzy Hash: B98121B2D042198FE728CF24CD89AEABBB5EBD0304F0481FFD0096A295D7795B85CE41
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 8$IE86$n$n$x
                                                  • API String ID: 0-1284800677
                                                  • Opcode ID: 35ec301d4d6fc3e393cee6bc7ea72fc2abf97a82ac43ab206e253b865c005c96
                                                  • Instruction ID: 2d870504935824d5b1c60d7c6c1daf778f50c2917c53e8f8ff50345b0a924e4a
                                                  • Opcode Fuzzy Hash: 35ec301d4d6fc3e393cee6bc7ea72fc2abf97a82ac43ab206e253b865c005c96
                                                  • Instruction Fuzzy Hash: 276142B2C082158FE724CB24CD896DABBB5EBD5308F0481EED0095B296D7395B85CF41
                                                  APIs
                                                  • CoInitialize.OLE32 ref: 00452A26
                                                  • CoCreateInstance.OLE32(0047D420,00000000,00000001,0047D400,?), ref: 00452A3F
                                                  • CoUninitialize.OLE32 ref: 00452A4F
                                                  • CoUninitialize.OLE32(?,?), ref: 00452A76
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Uninitialize$CreateInitializeInstance
                                                  • String ID:
                                                  • API String ID: 1968832861-0
                                                  • Opcode ID: 5b4eb627fcf7290a7e81d60cb7e5c256dbbf9200a0b1df13a91b3a442468134c
                                                  • Instruction ID: e79e93e122af3a4d20c7553f319c2a878f45d5cd0dc59cf8a110e0bb7069aab9
                                                  • Opcode Fuzzy Hash: 5b4eb627fcf7290a7e81d60cb7e5c256dbbf9200a0b1df13a91b3a442468134c
                                                  • Instruction Fuzzy Hash: 520192756083018FD300DF64DD85B5A77E4EF88B05F00885EF849A3291E674EC09CB6A
                                                  APIs
                                                  • FindFirstFileW.KERNEL32(?,00000003), ref: 0046300E
                                                  • FindClose.KERNEL32(00000000), ref: 0046301E
                                                    • Part of subcall function 004631F0: FindFirstFileW.KERNEL32(?,00000003,?), ref: 0046326C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Find$FileFirst$Close
                                                  • String ID:
                                                  • API String ID: 2810966245-0
                                                  • Opcode ID: ac525a0fc5c95755cc08b111d521eb121ac2ef7f5b05646f188b6f13116b70e9
                                                  • Instruction ID: 9b1d8f8ee81afef67cdd5002a011b417e39822a31e6c33f357b0cfbac9d9b473
                                                  • Opcode Fuzzy Hash: ac525a0fc5c95755cc08b111d521eb121ac2ef7f5b05646f188b6f13116b70e9
                                                  • Instruction Fuzzy Hash: A38161711083819FC314DF14D988AABBBE8FFD9715F000A2EF59A83291DB749948CB67
                                                  APIs
                                                  • DeviceIoControl.KERNEL32(?,00090064,00000000,00000000,?), ref: 00460093
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004600C0
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ControlDeviceUnothrow_t@std@@@__ehfuncinfo$??2@
                                                  • String ID:
                                                  • API String ID: 9847766-0
                                                  • Opcode ID: 41a6657a76e6a11c21828465e7547c488e33e83233d3adc9080a9250c0d0e56d
                                                  • Instruction ID: b288529985f008a1a54ef72dbef53761962e394cc992aae83e13a0fae47ca317
                                                  • Opcode Fuzzy Hash: 41a6657a76e6a11c21828465e7547c488e33e83233d3adc9080a9250c0d0e56d
                                                  • Instruction Fuzzy Hash: 40F09CB5254B01AFD324CF55D841F53B7F9AB88B04F104A1DB68A87680D775F814CB55
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: ExitProcess$LoadLibraryW
                                                  • API String ID: 0-1424737241
                                                  • Opcode ID: db6fb3462eb084c85b4d8c98aa89b91d1d7a9214b63e21ef73083f8b5ddffaf8
                                                  • Instruction ID: 5ead3ac3bd4aff6232ce0b085fc1346f7e5757dd7981177abaa08811ece2c49b
                                                  • Opcode Fuzzy Hash: db6fb3462eb084c85b4d8c98aa89b91d1d7a9214b63e21ef73083f8b5ddffaf8
                                                  • Instruction Fuzzy Hash: EF126AB1D041298BEB24CB14DC84BEAB7B6FB88314F1481FAD84967741DA395EC2CF95
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: `=
                                                  • API String ID: 0-2762138152
                                                  • Opcode ID: 85f5cf9130730ee42b46eecb9a97aaddfbcc8209bb5dd8c5a9308c75f3966b98
                                                  • Instruction ID: b08322f707590d6679d8a3345288254223faeb83914a9e5506ea8f8450595ff3
                                                  • Opcode Fuzzy Hash: 85f5cf9130730ee42b46eecb9a97aaddfbcc8209bb5dd8c5a9308c75f3966b98
                                                  • Instruction Fuzzy Hash: 61D27C716083459FD720DF24C880AABB7E5BF88705F14491EF989A7312DB34ED49CB9A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 52:C$63CL
                                                  • API String ID: 0-2743739360
                                                  • Opcode ID: 177800143185b1de29fa0f373a58a821fa7290bf26a02a80fd6530e2bc513eaa
                                                  • Instruction ID: ee6f5abe0d70e92fbee545af20c51d7f1a351eac5d5a97654fd1f05a3dd8048e
                                                  • Opcode Fuzzy Hash: 177800143185b1de29fa0f373a58a821fa7290bf26a02a80fd6530e2bc513eaa
                                                  • Instruction Fuzzy Hash: 0191E8B2D002559BF728CB24CD95EEFBB79EB84304F1481BAE40DA7680D7785B82CE51
                                                  APIs
                                                  • GetProcessHeap.KERNEL32 ref: 00474063
                                                  • HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00474074
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Heap$FreeProcess
                                                  • String ID:
                                                  • API String ID: 3859560861-0
                                                  • Opcode ID: 41a9c3f869f20d536b5df22bbdb68c6f72c4f4a03b7167ff54cc11ecf120ab97
                                                  • Instruction ID: 0e5b393c9cfaccf242b34e640deb84f37198d475fe7bd5f1c49fe5a9f1fc366a
                                                  • Opcode Fuzzy Hash: 41a9c3f869f20d536b5df22bbdb68c6f72c4f4a03b7167ff54cc11ecf120ab97
                                                  • Instruction Fuzzy Hash: BDF05E716002405BD7209FA5D848FA3779C9F85350F04C12EE65D873A1DB79E881CB99
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: XV
                                                  • API String ID: 0-2397409600
                                                  • Opcode ID: a33f44f40b3da12115a4c9157c8d5346dc6f7e1a2b94de2a08c23666a6cfb5df
                                                  • Instruction ID: d96f98e3104e8396b729325908ddcba1899f28d480a633a1da4195a397c5f7ad
                                                  • Opcode Fuzzy Hash: a33f44f40b3da12115a4c9157c8d5346dc6f7e1a2b94de2a08c23666a6cfb5df
                                                  • Instruction Fuzzy Hash: 3FD18AB1D052288BEB24CB54DC90BEAB7B5EF84314F1481EADA0D67640D7786EC2CF56
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 3?DB
                                                  • API String ID: 0-3760881731
                                                  • Opcode ID: 3948ffdc91642b507dd2076585be7fe9935ee047c4f41c65479af779dffd27df
                                                  • Instruction ID: 27bb131193966ac9c95de3c301efad271d9b67775ad35e27ebb7605d9cb9596a
                                                  • Opcode Fuzzy Hash: 3948ffdc91642b507dd2076585be7fe9935ee047c4f41c65479af779dffd27df
                                                  • Instruction Fuzzy Hash: 28A104B2D141199BFB248F25DD94BFA77B5EB80300F1481FAE44D96680E67C5EC2CA25
                                                  APIs
                                                  • IsIconic.USER32(?), ref: 00420B4C
                                                    • Part of subcall function 00420970: GetWindowRect.USER32(?,?), ref: 004209E6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: IconicRectWindow
                                                  • String ID:
                                                  • API String ID: 3467660236-0
                                                  • Opcode ID: 6369986c62335c2f169f127993e99def2b7867e344ea96c29496c685a54ad688
                                                  • Instruction ID: f9d6239d05f36fe70fa0ff212e7df7f15f460ae1a1a005da7839878c6ec85a4b
                                                  • Opcode Fuzzy Hash: 6369986c62335c2f169f127993e99def2b7867e344ea96c29496c685a54ad688
                                                  • Instruction Fuzzy Hash: 58E012723002348BD7319B65A444B9736E87B04788F8445EFA045C71B2D768E884C65C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: XV
                                                  • API String ID: 0-2397409600
                                                  • Opcode ID: c1370a59e6fc1e046741bec248d7e13d2fd463ee2a5846021b3b8c969810d725
                                                  • Instruction ID: 0c2c72fe587b25a4d722c9f036eadaef8d5eb7f600670bb6867ee190173edce1
                                                  • Opcode Fuzzy Hash: c1370a59e6fc1e046741bec248d7e13d2fd463ee2a5846021b3b8c969810d725
                                                  • Instruction Fuzzy Hash: 3491C1B2E146688AEB208B25DC447EBB675FF94300F1041FAD94DA7280E7795EC1CF56
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: ExitProcess
                                                  • API String ID: 0-621844428
                                                  • Opcode ID: d5c9bb3fcf64a1020e69f98160aa3041b1b3e26b9d31c0829e0a5af3ffcb550b
                                                  • Instruction ID: 78bb199c4dc6b25a3d490fb8700b5dcb76a03c02edc8eb06d3ea702f73d8cc79
                                                  • Opcode Fuzzy Hash: d5c9bb3fcf64a1020e69f98160aa3041b1b3e26b9d31c0829e0a5af3ffcb550b
                                                  • Instruction Fuzzy Hash: 56A168B0D042698BEB24CB14CC94BEAB7B1FB88345F1491EAE94967245DB386EC1CF45
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: CPUIdleTime
                                                  • API String ID: 0-751903288
                                                  • Opcode ID: bd23e8ab83a0d97d2f2be9aa9650afb2e034dca1436bd6d9716515e492d8ce81
                                                  • Instruction ID: ad0ed2d3d7b8121e96830e58ddd7a8af266cdeacc1b3584042cdcdde07e77cbf
                                                  • Opcode Fuzzy Hash: bd23e8ab83a0d97d2f2be9aa9650afb2e034dca1436bd6d9716515e492d8ce81
                                                  • Instruction Fuzzy Hash: 4581ADB1D141689AFB248B11DC547EBB675FF94310F1081FAD80EA7380EA7D9EC18B56
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 88ac8324263c94513a4a5bb9ec3d1476c03cfc6191eb9c2d9b4003fa79569243
                                                  • Instruction ID: 1d8b4f44054b6808153721028e6f2b61e0b55fb5b2949cffaf98511a3b6460c3
                                                  • Opcode Fuzzy Hash: 88ac8324263c94513a4a5bb9ec3d1476c03cfc6191eb9c2d9b4003fa79569243
                                                  • Instruction Fuzzy Hash: DE429EB1D046289BEB24CB14DC80BEABB75EB85315F1481FAD80D67681D7389FC2CE85
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: fd97b2a0862ed9ecdc711cf8d83fc2d2df6727d7fcae209dae3682ec711098aa
                                                  • Instruction ID: b8bb97dd4ad3e9b78dead8eb637ad17cd35db6771a733a4615ae5404d799fc3f
                                                  • Opcode Fuzzy Hash: fd97b2a0862ed9ecdc711cf8d83fc2d2df6727d7fcae209dae3682ec711098aa
                                                  • Instruction Fuzzy Hash: DA32E1B2D042289AEB248B14EC95BFF7BB5EB85314F2481EAD44D66280D67C5FC1CF52
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 0291cfb27c3f71e1ddb9f7929d63c3d90c18a971ef9431a159bf74b7d0f39afd
                                                  • Instruction ID: 560df841f5a39d15165254c387fedf7050e312fb996d014518e159206f825ece
                                                  • Opcode Fuzzy Hash: 0291cfb27c3f71e1ddb9f7929d63c3d90c18a971ef9431a159bf74b7d0f39afd
                                                  • Instruction Fuzzy Hash: 5702CDB1E145288FEB24CE24CD90BEAB7B5FB85300F5481EAE84DA6640D6785FC2CF55
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e536160d0e77da4d7663a1e7208f800c105ecd2e8302ae2c7ca3b38f9178e749
                                                  • Instruction ID: 1a5313fc547754b7558944cc10637dbc9442f210c2f220681e0359fc69f90577
                                                  • Opcode Fuzzy Hash: e536160d0e77da4d7663a1e7208f800c105ecd2e8302ae2c7ca3b38f9178e749
                                                  • Instruction Fuzzy Hash: 0FD1F2B2D041289FF7248A15DC95AFBB775EB80310F1481BAE80DA7681E77C5EC2CE56
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d50ab917444e38bdb2a1f9d5ec1d64d70613830ae1198aef3bfac761906bf0cc
                                                  • Instruction ID: 5034aca3ef28b0049a5fcb9b63e143b4aad7342eb8a74ce941f9c63387341e2b
                                                  • Opcode Fuzzy Hash: d50ab917444e38bdb2a1f9d5ec1d64d70613830ae1198aef3bfac761906bf0cc
                                                  • Instruction Fuzzy Hash: C3F1AAB1D046688FEB24CA14CC90BEABBB5EB84304F1481EAD84DA7241D7796FD5CF91
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 952074ad9440fabd77adc9cd1f925f3c40d84af1d041a0bd84eff85e9f0ec51f
                                                  • Instruction ID: c3c0aaf102953d6304c5f7ab297ce38081f26adac517cac24aabe453ea6b0ae6
                                                  • Opcode Fuzzy Hash: 952074ad9440fabd77adc9cd1f925f3c40d84af1d041a0bd84eff85e9f0ec51f
                                                  • Instruction Fuzzy Hash: 32D160B1D056288FEB25CB14CCA0BEAB7B5FB88315F1491EAD60D66341D7386EC18F85
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b6567b2d7875b5f338b5f0fbea0ad0f9450f0d6305f10c4be9446589e9a2ea6b
                                                  • Instruction ID: b891e9d605b094f013577b19c17c8da6dfd56754519348dbc218ef3056efc57a
                                                  • Opcode Fuzzy Hash: b6567b2d7875b5f338b5f0fbea0ad0f9450f0d6305f10c4be9446589e9a2ea6b
                                                  • Instruction Fuzzy Hash: 51C1E0B2D041189FF7208A11DC85BFBB775EB80314F1481BAE809A6280E77C6ED2CF56
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 392d7faa8d06d3780510d4f742f9d819ce7a6dc7368c878a1e358b71b49e405d
                                                  • Instruction ID: d9bfd5f51839426014274737fe1cd07fd504b7de237bdef525cd87a8aeb6fbf5
                                                  • Opcode Fuzzy Hash: 392d7faa8d06d3780510d4f742f9d819ce7a6dc7368c878a1e358b71b49e405d
                                                  • Instruction Fuzzy Hash: C2C1AEB1D142288AFB248B25DC94BEAB3B5EF98300F1091FAD50DA7384D27D5EC58F55
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b128170cec23ed85e029a0c7551b441e190a404c99065ec458f5ff6e1bf4833e
                                                  • Instruction ID: a8a60f4675ba5f1ec8d2c8035993d72a3da99eed47559d94717251f4ac8abe93
                                                  • Opcode Fuzzy Hash: b128170cec23ed85e029a0c7551b441e190a404c99065ec458f5ff6e1bf4833e
                                                  • Instruction Fuzzy Hash: 66C1EFB1C046288BFB248B24CC55BEAB7B5EF40314F1481FAD84D66281E6796EC5CF66
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c6c7ca6a3f5b7098475815498347e00e7bf086f63b5693551e51f1a53adfbca1
                                                  • Instruction ID: fd2adcf6aaea1861b4e3c3824d33abb02856b2b7868f42656e308c880416e804
                                                  • Opcode Fuzzy Hash: c6c7ca6a3f5b7098475815498347e00e7bf086f63b5693551e51f1a53adfbca1
                                                  • Instruction Fuzzy Hash: A4C1A2B1D042689BEB24CB14CC54BEAB7B4EB49310F1481FAD84D66281D7786FC5CF91
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 0a33595241869a0f6fd26b43e9a57a888a3f24e9408b6fc9bd1e733ef7873147
                                                  • Instruction ID: 91dad6f60474e48ada33b28c25d5891ad4fe688ec4bf30499607de689c8e7352
                                                  • Opcode Fuzzy Hash: 0a33595241869a0f6fd26b43e9a57a888a3f24e9408b6fc9bd1e733ef7873147
                                                  • Instruction Fuzzy Hash: 52A1D2B1D102289FFB248A24DC84BEAB775EB84314F1481FAD80D97380D7386ED1CE65
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a57a128d1c16c12dcf4902804604208ecf22197fe885c780f8585ef138a26dff
                                                  • Instruction ID: 5f65285439b790b28c0d3b905ad07066762363c037cdec378342d8cce10f23cf
                                                  • Opcode Fuzzy Hash: a57a128d1c16c12dcf4902804604208ecf22197fe885c780f8585ef138a26dff
                                                  • Instruction Fuzzy Hash: 37B129316106099FD725CF28C48AB697FA0FF45364F298A58E89ACF2E1C375E991CB40
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d25b3c216cf66edde9642ae73ea0533636aac5cf1da252078bd96ba0fd332c9c
                                                  • Instruction ID: 7aa6c2774149c771a709c1979d012d9de319947fed01decd4d2a4b657a4558a9
                                                  • Opcode Fuzzy Hash: d25b3c216cf66edde9642ae73ea0533636aac5cf1da252078bd96ba0fd332c9c
                                                  • Instruction Fuzzy Hash: C3B180B1D081689BEB24CA14CC94BEABBB5EF49311F1481FAD84DA6241D63C5FC5CF92
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c0ae1bee459ce306232fce81542ed9435c614c41596a8a2b0cb06b1669161357
                                                  • Instruction ID: bd8498e19c7fa7d260844e27fbd2470e9dd7af5422cdf3eeb86431aa034937df
                                                  • Opcode Fuzzy Hash: c0ae1bee459ce306232fce81542ed9435c614c41596a8a2b0cb06b1669161357
                                                  • Instruction Fuzzy Hash: CD91C0B2D041289FF7108A05DC81BFBB775EB81315F1481BAE849A6281E33D6ED2DE56
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 098fb83eec7d6e8bfe752b7dfbb5c7604bcc6f88ed78d73aea90a6045a29027f
                                                  • Instruction ID: 32e48b6b83af697efbd95f1b560071a0bef27cbfb3752ff45f98ef9fda224aec
                                                  • Opcode Fuzzy Hash: 098fb83eec7d6e8bfe752b7dfbb5c7604bcc6f88ed78d73aea90a6045a29027f
                                                  • Instruction Fuzzy Hash: 8991C1B1D041289FF7108B05DC81BFBB775EB81315F1481BAE849A6281E33D6ED1DE56
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 52938339808abb28f7ade17674fcb141ef85d81a7925c6783e905eb32907377b
                                                  • Instruction ID: 3136c16c425243aef91910589b423563198828c2d039b6bf6d62d98ee873af78
                                                  • Opcode Fuzzy Hash: 52938339808abb28f7ade17674fcb141ef85d81a7925c6783e905eb32907377b
                                                  • Instruction Fuzzy Hash: DD91AEB2D046688AEB20CA14CC547DABBB5EF54300F1491FAD84DA7281D7786FC5CFA6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 8837bec5fbae9aea7ab5225c6e9500948fb9a8847e7beb06c8b8ce8c31ac11e5
                                                  • Instruction ID: 8253d510d70789b902fb468741b514a30da85399b0f3c609bc6b324c2a426dfb
                                                  • Opcode Fuzzy Hash: 8837bec5fbae9aea7ab5225c6e9500948fb9a8847e7beb06c8b8ce8c31ac11e5
                                                  • Instruction Fuzzy Hash: 0B91C661D1C2648AFB208B25DC447EABAB6EF55304F0480FAD44DA7281E37D4ED6CF66
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ab603a9d1c3f3c35627ff219e88850ace420042e2909a292aaf6f13112a14398
                                                  • Instruction ID: 12559a6c71f650d4e1e232258dcd829da44912fbb7061d7a6d22df0412f76cbd
                                                  • Opcode Fuzzy Hash: ab603a9d1c3f3c35627ff219e88850ace420042e2909a292aaf6f13112a14398
                                                  • Instruction Fuzzy Hash: 2381E4B1C046688FFB24CA14CC45BEB7BB4EB40314F1480FAD84D66281D67D6EC58FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: bd35362e8f6a0a739aec3d72ca2c27fdee492873fab6136eca9f7d97bfe3e9be
                                                  • Instruction ID: 3c14bea9c358a8e468eaebe025ed9b539a649f1b5c8ecb2847a0812a910a9550
                                                  • Opcode Fuzzy Hash: bd35362e8f6a0a739aec3d72ca2c27fdee492873fab6136eca9f7d97bfe3e9be
                                                  • Instruction Fuzzy Hash: 6E81A5B1C046689FFB20CA24CC54BEA7BB4EB45314F1481FAD84DA6281D77D5EC58FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 6a7c77ad15760cb7f8d9e8d243fb68bbb4f55981b93fe2e79a229b1140bc6696
                                                  • Instruction ID: 3debfd5754616c495730c777237b9088ce264dd7254c7f8f38febbca1aed2fbd
                                                  • Opcode Fuzzy Hash: 6a7c77ad15760cb7f8d9e8d243fb68bbb4f55981b93fe2e79a229b1140bc6696
                                                  • Instruction Fuzzy Hash: A691B3B2D046688AEB208B14CC447EABBB5FB95310F1490FAD84D67281D67C5EC5CFA6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: deb56b1e4eb79d6d5a248d9c66bb43a61403098fa43664022b8106b8d16acdbc
                                                  • Instruction ID: 39063da39f4decb22109ab13952be860e9e8bfc14cad7b0eb5767214cac200d9
                                                  • Opcode Fuzzy Hash: deb56b1e4eb79d6d5a248d9c66bb43a61403098fa43664022b8106b8d16acdbc
                                                  • Instruction Fuzzy Hash: 2081AEB2D042688AEB20CA14DC547DABBB5EB54300F1490FAD84D67381D7786FC9CFA6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 0018febf4fc4f6f1adeb23baed50a6a8edbd83e6b29d82a3ed8266eeb3a3a738
                                                  • Instruction ID: ec7218d5b0f71017cd4828cdcdc313e30641bc90b8717218682c0a11ac1eb5e5
                                                  • Opcode Fuzzy Hash: 0018febf4fc4f6f1adeb23baed50a6a8edbd83e6b29d82a3ed8266eeb3a3a738
                                                  • Instruction Fuzzy Hash: A76199B2D085248FF7248A24DC54BFB7B78EB41301F1441BBE80E56681E67C5ECA8E53
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d6986ffefab42b3500ae0ee9028605c647c3131d2bcee8d9c3f4f20a43ecb76b
                                                  • Instruction ID: 398ab17d2c1185150683b6881de60b99f664a4f2f69cf53e5635fe6e7f5a4471
                                                  • Opcode Fuzzy Hash: d6986ffefab42b3500ae0ee9028605c647c3131d2bcee8d9c3f4f20a43ecb76b
                                                  • Instruction Fuzzy Hash: EF71F8B3D052645FE728CA24CD95AEFBB79EB84314F0181FAE90DA6184D6785FC2CE41
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e301597d7562ca4cb6c10450e7454b7e4f56bd07f88abaaf41bfcc9b50f619a3
                                                  • Instruction ID: aa75d38bf0b5000f6cf0d86861a3ba98b625ed047dcda2fadb0c320d487b146c
                                                  • Opcode Fuzzy Hash: e301597d7562ca4cb6c10450e7454b7e4f56bd07f88abaaf41bfcc9b50f619a3
                                                  • Instruction Fuzzy Hash: 0D7159B2E042549EF7248A25DC847EA7BB5EB82304F04C1FEE44D96681DA7D0BC5CF62
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 32e687f7242b97c27eb7c221f9717e8f3a168fffad5e5c78a1aac7840dcc4091
                                                  • Instruction ID: 77c7ae618b326c043c8c67dcbf329019b61b8f9e6de6ab4aa1174f950d4d68c7
                                                  • Opcode Fuzzy Hash: 32e687f7242b97c27eb7c221f9717e8f3a168fffad5e5c78a1aac7840dcc4091
                                                  • Instruction Fuzzy Hash: 9B71E7B2D051655AF728CA24DD95AEFBB79EB84314F0081FAE80DA6284C7785FC2CD41
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9292262be2d8e62e8c2c5ef45b49c82eefe612c6f6c42da4c3fa0e0eb09e276c
                                                  • Instruction ID: 23ea52d75727cce051fdd6f5516660ccea011c6cf23734b33c0f11c136ce808d
                                                  • Opcode Fuzzy Hash: 9292262be2d8e62e8c2c5ef45b49c82eefe612c6f6c42da4c3fa0e0eb09e276c
                                                  • Instruction Fuzzy Hash: 9C7148B2D042549EF7248A25DC847EA7BB5EB92304F04C1FAE48D96681DA7D0BC5CF62
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: ef8f3af63496425e2dde1ecf991378581f33d4a8c8f1a0aa9dfece8849b5e1b8
                                                  • Instruction ID: 8b5d3a3a8aa746802dbb7c3a97e10b7e2e342028cbcac49a8b8279d218a7febc
                                                  • Opcode Fuzzy Hash: ef8f3af63496425e2dde1ecf991378581f33d4a8c8f1a0aa9dfece8849b5e1b8
                                                  • Instruction Fuzzy Hash: 9F81CFB1D182688AFB24CA25DC447EAB7B2EF44304F0081FAD54DA7681D77A5EC58F16
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 79e997740ee015f8c848747353a52054738584486426e59d0f8a97ee3145fe02
                                                  • Instruction ID: 835f0f47eb51271cf5b669bf441317e1938b739c050c372abf3cf27d9af3937f
                                                  • Opcode Fuzzy Hash: 79e997740ee015f8c848747353a52054738584486426e59d0f8a97ee3145fe02
                                                  • Instruction Fuzzy Hash: 9471C2B1D081A89BFB20CA24DC447EA7BB4EB45310F1481FAD84D66281D67D5FC9CFA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9a134508a80dcb553580b5ac61f4f5292ded0c08208d63d543d06bd003a2bc60
                                                  • Instruction ID: 63210187baf3a13440e4d13f26026d0c8c713c46b47094e8d8447517e6217c4f
                                                  • Opcode Fuzzy Hash: 9a134508a80dcb553580b5ac61f4f5292ded0c08208d63d543d06bd003a2bc60
                                                  • Instruction Fuzzy Hash: BF71B361D186A88AF7208B25DC447EABAB6FF55304F0484FAD44CA7281E37E4EC5CF56
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 2e32509d19cf69dda2c90ef60e29bf141446e8350d7d39d16b13c0ce06dc4744
                                                  • Instruction ID: 5644f95f38fc800653b3bc9cbba4b2c306ffedad786c96c3b13cccd40def0888
                                                  • Opcode Fuzzy Hash: 2e32509d19cf69dda2c90ef60e29bf141446e8350d7d39d16b13c0ce06dc4744
                                                  • Instruction Fuzzy Hash: 4C51CFB2D0416A8AE7248B21DC40BFBB775EB94310F1481FBE80E66280E73C5EC6CE55
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 7849633e57f910839e063532516577a2e3727bb3d1db33bdcf58eff5644fb61d
                                                  • Instruction ID: aa64ed0fbb13cf27e59d52b6728ceebd1b90ec085ab95b10ab231d42a18e2f33
                                                  • Opcode Fuzzy Hash: 7849633e57f910839e063532516577a2e3727bb3d1db33bdcf58eff5644fb61d
                                                  • Instruction Fuzzy Hash: E55126B2E085649AF7208A25DC90BFF7775EF85311F5881FAE84D92640D67C5EC28E42
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 87e78c235d9faf2b6e9345a32092ee6d83c326a5270b4da1efff71f182287421
                                                  • Instruction ID: ba37619d8168a8e0b8df478e1ffa1d0aba2d8aa96a4d322afad6b3c51ce39c99
                                                  • Opcode Fuzzy Hash: 87e78c235d9faf2b6e9345a32092ee6d83c326a5270b4da1efff71f182287421
                                                  • Instruction Fuzzy Hash: 1461BFB2C081688AF724CA14CD54BEA7BB5EB80310F1481FAD88D66281D77D5FC58FA6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 9c2aaf39649fdce6cb058863bc06b16f750b201beecb215f2c3aca8bc9ce7c89
                                                  • Instruction ID: 0fe318a103a92335317881af1183c0be9e59c3f05cac2b2377be2c652e9c3a09
                                                  • Opcode Fuzzy Hash: 9c2aaf39649fdce6cb058863bc06b16f750b201beecb215f2c3aca8bc9ce7c89
                                                  • Instruction Fuzzy Hash: 1761A1B1C046688BFB60CA14CC45BEA7BB5EB41314F1480FAD84C66281D77D5FCA8FA6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e0e09165a8ef098327a8555600839c5a4a32aa779dba3b27cbcbff9bc47799d5
                                                  • Instruction ID: 738f02ced40869263c030df9b8a29bab5e5f9319c681b5b1a6634bafb06a1bb8
                                                  • Opcode Fuzzy Hash: e0e09165a8ef098327a8555600839c5a4a32aa779dba3b27cbcbff9bc47799d5
                                                  • Instruction Fuzzy Hash: 0C51C4B1C046688FF7608A14CC55BEB7BB5EB41314F1480FAD88C66282D67D5FC98FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: c6c3b3f179eee7cae68d36a4bc7cec5d57bda508eedf4564acf412783a15561b
                                                  • Instruction ID: 6eacb5cf516a187de6133fe52b5b0010462d17a9dd65571bdba597433d33116f
                                                  • Opcode Fuzzy Hash: c6c3b3f179eee7cae68d36a4bc7cec5d57bda508eedf4564acf412783a15561b
                                                  • Instruction Fuzzy Hash: DA5192B1C046688FFB60CA14CC45BEA7BB5EB45314F1480FAD88C66281D7795FC98FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 3965249998f4193384cba53f1414835f3f8b9e6a63fc3221dee9070b9e33f81d
                                                  • Instruction ID: 20e6eeed919b0624fc0304e34d160d7de63f094fda7ebd58f75e9aaf142c626d
                                                  • Opcode Fuzzy Hash: 3965249998f4193384cba53f1414835f3f8b9e6a63fc3221dee9070b9e33f81d
                                                  • Instruction Fuzzy Hash: 5551E1B1C046688BFB20CA14CC55BEB7BB5EB40314F1480FAD88C66281D67D1FC98FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 7d84a6aa7db4e4b79728f8b3ea30da1f6baab53dc2d6aa9d30b2866ec5de6516
                                                  • Instruction ID: 46b1b3f068651b9d910f56a1a4b7188e8c19f9b99d160080f2204827421a8507
                                                  • Opcode Fuzzy Hash: 7d84a6aa7db4e4b79728f8b3ea30da1f6baab53dc2d6aa9d30b2866ec5de6516
                                                  • Instruction Fuzzy Hash: 3351B5B1C046689FF764CA14CD45BEB7BA5EB40314F0480F9D84C66281D67D6FC98FA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: abe34f388f4c29266e44c5a5869385f143c3b39c9c55a0b844e145c39cb4d256
                                                  • Instruction ID: 92642753ca4564f07ecfb27b612f3392ef5a31460e011a9d93dedd6c84a0b17a
                                                  • Opcode Fuzzy Hash: abe34f388f4c29266e44c5a5869385f143c3b39c9c55a0b844e145c39cb4d256
                                                  • Instruction Fuzzy Hash: CB5191B2D042559FE728CB15DD95AEEBBB5EB94304F0481FAD80D57284DAB89BC2CF01
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b138c6354b4794159b07fc6609eb057336e64053b4bb1863baa125d706c9e9b3
                                                  • Instruction ID: 9ebfa40df093149e3179e959a92e922e2ba3b9340a2bcea3d81bd249ccf2aea6
                                                  • Opcode Fuzzy Hash: b138c6354b4794159b07fc6609eb057336e64053b4bb1863baa125d706c9e9b3
                                                  • Instruction Fuzzy Hash: 7051E5B2D051649AE728CA24CD96AEFBB79EB84314F0081FAE90DA7184C7785BC2CD41
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 193ee71bb4219eb56612ecd312c4419e302a5ed9f49001b7e0465b3d0f90fd54
                                                  • Instruction ID: 1e6ae11eecee1b83898ede065f6c0902e16aff3f515b9f00e4b9fb02dc7855d5
                                                  • Opcode Fuzzy Hash: 193ee71bb4219eb56612ecd312c4419e302a5ed9f49001b7e0465b3d0f90fd54
                                                  • Instruction Fuzzy Hash: 51519DB1A002058FEB25CF65D9997AEBBF0FB48350F25847AC805EB2A0D3749D84CF90
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 879238f6046bdeac136798c3e262d3e045586c080da6da92549ce9ff9bb28e3b
                                                  • Instruction ID: 75e5bfbfafba76e55aaa5d8984acc5411fb8b29ead09f334804be1eebdc3965c
                                                  • Opcode Fuzzy Hash: 879238f6046bdeac136798c3e262d3e045586c080da6da92549ce9ff9bb28e3b
                                                  • Instruction Fuzzy Hash: 8E51CEB1C042688AFB68CA14DC557EABBB5EB45300F0480FAC84D66281C77C5FC5CFA6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 199152c092a8b2d48ce95239b513c2fc15c67134b4c36577502c54b443a95eb7
                                                  • Instruction ID: 1c74d19e802c4637d81bfd9306ce0beeccd8261d75f73b5975dabde85926c70f
                                                  • Opcode Fuzzy Hash: 199152c092a8b2d48ce95239b513c2fc15c67134b4c36577502c54b443a95eb7
                                                  • Instruction Fuzzy Hash: 4E51D6B2D051649AF728CA24DD95AEFBB79EB84314F0081FAE90DA7284D7785FC2CD41
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 43414089140debf4f5089db83cc504b9a8a5a957f7d64db7e154c1d287584204
                                                  • Instruction ID: b6d3202c53c6945c490402fd1047952626fece3e38bf6a063a689645bae99a11
                                                  • Opcode Fuzzy Hash: 43414089140debf4f5089db83cc504b9a8a5a957f7d64db7e154c1d287584204
                                                  • Instruction Fuzzy Hash: BB51DEB1C081688EFB24CA15DC55BEA7BB5EF41314F1480FAD48D66281DA7D1AC9CFA2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 045bcd2d08775f1169ac6fb7c0d0a2d467c3a39ac19f69c6f9f097e0e431c7b5
                                                  • Instruction ID: fb68e04730c9a5a0c30f472f66ff690ed2a810e07b3ef3c1094669fea3eba2a6
                                                  • Opcode Fuzzy Hash: 045bcd2d08775f1169ac6fb7c0d0a2d467c3a39ac19f69c6f9f097e0e431c7b5
                                                  • Instruction Fuzzy Hash: 7A41C3B1D4411A8BE724CB24CC50AFEB771EF98300F1491FED54A9B640EA386AC1CF16
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d6eb95aebdd0832f893845c2801e487cae1a373ae23844e6cf616ad7b7813bce
                                                  • Instruction ID: 25f691dd9f4b04871031b08211d0b3aff43497b52775273811143d25c2d92c00
                                                  • Opcode Fuzzy Hash: d6eb95aebdd0832f893845c2801e487cae1a373ae23844e6cf616ad7b7813bce
                                                  • Instruction Fuzzy Hash: 0211C933769A1007E76C843C58523AB418743E5738F298B2FA936C63E8E97DCD42515E
                                                  APIs
                                                    • Part of subcall function 0041DB30: GetLogicalDrives.KERNEL32 ref: 0041DB47
                                                    • Part of subcall function 0041DB30: GetDriveTypeW.KERNEL32(?,?,?,75A7AF60), ref: 0041DB8A
                                                  • SendMessageW.USER32(?,00001037,00000000,00000000), ref: 0040218F
                                                  • SendMessageW.USER32(?,00001036,00000000,00000000), ref: 004021A2
                                                    • Part of subcall function 0041A9B0: SHGetFileInfoW.SHELL32(%SystemRoot%,00000040,000002B4,000002B4,00004011), ref: 0041A9DA
                                                  • SendMessageW.USER32(?,00001003,00000001,?), ref: 004021C3
                                                  • LoadBitmapW.USER32(00000000,00000090), ref: 0040221B
                                                  • SendMessageW.USER32(?,00001208,00000000,?), ref: 0040227F
                                                  • SendMessageW.USER32(00000000,00000405,00000001,00000000), ref: 00402370
                                                    • Part of subcall function 00402590: SendMessageW.USER32(?,00000400,00000000,00000000), ref: 004025C2
                                                  • SendMessageW.USER32(?,00000405,00000001,00000000), ref: 004023B9
                                                    • Part of subcall function 00402660: SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00402692
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$BitmapDriveDrivesFileInfoLoadLogicalType
                                                  • String ID: 3402003$3402041$3402043$3402046$3402047$3402048$CPUIdleTime$CPUUsageExceed$DefragmentedFiles$DiskDefrag\AutoDefragmention$LastDefragmention$tG
                                                  • API String ID: 3599163918-2734650818
                                                  • Opcode ID: 0b657ecd60b9bac2b9040caf1b0c8941b02365fce508479a01bd82f39a587853
                                                  • Instruction ID: bcfd938aa366970316b1685172ea95c37501a647d75b412e58de97171c7dff61
                                                  • Opcode Fuzzy Hash: 0b657ecd60b9bac2b9040caf1b0c8941b02365fce508479a01bd82f39a587853
                                                  • Instruction Fuzzy Hash: A4A1D9B17503006BD710FF618D86FAE36A89F44714F10892EF60E7B2D2DABCA844875E
                                                  APIs
                                                  • GetCursorPos.USER32(00000000), ref: 0042872A
                                                  • CreatePopupMenu.USER32 ref: 00428751
                                                  • AppendMenuW.USER32(?,00000000,00008022,00000000), ref: 0042878F
                                                  • AppendMenuW.USER32(?,00000000,00008027,00000000), ref: 004287BB
                                                  • AppendMenuW.USER32(?,00000000,00008028,00000000), ref: 004287E7
                                                  • AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 004287F6
                                                  • AppendMenuW.USER32(?,00000000,00008023,00000000), ref: 00428822
                                                  • AppendMenuW.USER32(?,00000000,00008024,00000000), ref: 0042884E
                                                  • AppendMenuW.USER32(?,00000000,00008025,00000000), ref: 0042887A
                                                  • AppendMenuW.USER32(?,00000800,00000000,00000000), ref: 00428889
                                                  • AppendMenuW.USER32(?,00000000,00008026,00000000), ref: 004288B5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Menu$Append$CreateCursorPopup
                                                  • String ID: 10021$3401032$3401033$3401086$3401099$3401127$3401128
                                                  • API String ID: 2468982102-1766060818
                                                  • Opcode ID: 0f288ede21beddef441f7f8c0533aa301f031c1d0427cbd65ca3cc463743e8ce
                                                  • Instruction ID: 3f46f92896953761dbd981ebaed820fc3143a3776dcc1953a56c74fff761f47c
                                                  • Opcode Fuzzy Hash: 0f288ede21beddef441f7f8c0533aa301f031c1d0427cbd65ca3cc463743e8ce
                                                  • Instruction Fuzzy Hash: C9319DF5BD030076D2A066A58D57F9A76A99F84F00F31C80BB74E769C1CAECB4045BAD
                                                  APIs
                                                  • GetComboBoxInfo.USER32 ref: 00416520
                                                  • CreateCompatibleDC.GDI32(?), ref: 0041654D
                                                  • GetMapMode.GDI32(?,00000000), ref: 00416561
                                                  • GetClientRect.USER32(?,?), ref: 0041658E
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 004165AA
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 004165D5
                                                  • OpenThemeData.UXTHEME(?,COMBOBOX,?,00FFFFFF,00000000,00000000), ref: 00416607
                                                  • DrawThemeBackground.UXTHEME(00000000,?,00000005,00000003,?,00000000), ref: 00416652
                                                  • DrawThemeBackground.UXTHEME(00000000,?,00000001,00000001,?,00000000), ref: 0041666C
                                                  • CloseThemeData.UXTHEME(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00416673
                                                  • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0041668C
                                                  • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004166A3
                                                  • BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 004167D1
                                                    • Part of subcall function 00416DD0: CopyRect.USER32(?,?), ref: 00416E1C
                                                  • FrameRect.USER32(?,?,00000000), ref: 0041681A
                                                  • CopyRect.USER32(?,?), ref: 0041683E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: RectTheme$MessageSend$BackgroundCompatibleCopyCreateDataDraw$BitmapClientCloseComboFrameInfoModeOpen
                                                  • String ID: 4$COMBOBOX
                                                  • API String ID: 3327461832-2064896087
                                                  • Opcode ID: f4382f38c21f4a5feac0cb5c973d886d581c1a15e61b57e088f077fda26ce5f3
                                                  • Instruction ID: 20267cedc47a1196732836afe1a8f8ceed4fa11fcf58e3e8436092e3fc6905d6
                                                  • Opcode Fuzzy Hash: f4382f38c21f4a5feac0cb5c973d886d581c1a15e61b57e088f077fda26ce5f3
                                                  • Instruction Fuzzy Hash: 5BC138B1508300AFD314DF65C985FABB7E8BF88704F008A1EF58997291DB74E944CB96
                                                  APIs
                                                  • SendMessageW.USER32(0047D9D0,00001037,00000000,00000000), ref: 004322A8
                                                  • SendMessageW.USER32(?,00001036,00000000,00000000), ref: 004322BC
                                                  • SendMessageW.USER32(?,0000101E,00000001,0000FFFE), ref: 00432329
                                                  • SendMessageW.USER32(?,00000143,00000000,?), ref: 00432523
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402006$3402028$3402029$3402030$3402031$3402032$3402033$3402034$3402035$3402036$3402037$`=
                                                  • API String ID: 3850602802-2611688555
                                                  • Opcode ID: 1d33559db68a23795c865535f7ffa7567719b6a4943160a90e18ad29cdad3874
                                                  • Instruction ID: 1f5745e592a7c845df3e12826af7c739e18eef66d9bd278cacb692334ad6c886
                                                  • Opcode Fuzzy Hash: 1d33559db68a23795c865535f7ffa7567719b6a4943160a90e18ad29cdad3874
                                                  • Instruction Fuzzy Hash: B1A194B0B50301ABD310AF658D82FAE73A5AF48B04F10491FFA5EB76D1D7A8BD00965D
                                                  APIs
                                                  • GetObjectW.GDI32(?,0000005C,?), ref: 0040AEFA
                                                  • MulDiv.KERNEL32(?,?,00000048), ref: 0040AF5E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Object
                                                  • String ID: CharSet$ClipPrecision$Escapement$Italic$Name$Orientation$OutPrecision$PitchAndFamily$Quality$Size$StrikeOut$Underline$Weight
                                                  • API String ID: 2936123098-848768055
                                                  • Opcode ID: 581e2151a43bffb8372fa4f7334b51b32000fb86fe427fbed1d6e470a93a997b
                                                  • Instruction ID: 678cc5ad66024a4e3a2d6689a74d43ebfb952ff3fe0b92c748617c9598e0b8bb
                                                  • Opcode Fuzzy Hash: 581e2151a43bffb8372fa4f7334b51b32000fb86fe427fbed1d6e470a93a997b
                                                  • Instruction Fuzzy Hash: 2E021371508740DFD360DF61C984B5BB7F9EB88304F108A2EF98A87291D778A944CFA6
                                                  APIs
                                                  • SendMessageW.USER32(?,00001013,?,00000000), ref: 004217C5
                                                  • SendMessageW.USER32(?,00001027,00000000,00000000), ref: 0042187C
                                                  • SendMessageW.USER32(?,00001028,00000000,00000000), ref: 00421890
                                                  • SendMessageW.USER32(?,00001027,00000000,00000000), ref: 004218A6
                                                  • SendMessageW.USER32(?,00001015,00000000,00000000), ref: 004218BC
                                                    • Part of subcall function 00421580: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,004217B6,?,B7F9C0F2), ref: 004215AC
                                                  • GetTickCount.KERNEL32 ref: 004218F0
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$CountRedrawTickWindow
                                                  • String ID: 3401097$ScheduleStart$`=
                                                  • API String ID: 1016491994-4255795148
                                                  • Opcode ID: 059351e3aaae428ad539f55a8dcfe394caba1a022192f3b5fcbeae5e242c694e
                                                  • Instruction ID: a2f7d2ab4a79c621e2b3341a28b2bdd177a5bb8c7450e01432b01053e343f094
                                                  • Opcode Fuzzy Hash: 059351e3aaae428ad539f55a8dcfe394caba1a022192f3b5fcbeae5e242c694e
                                                  • Instruction Fuzzy Hash: 2FB117717003119BC720EF64DCC5FAA77A5AF94710F50493EF9099B2E1DB78A844CBAA
                                                  APIs
                                                  • GdipGetImagePixelFormat.GDIPLUS(?,?), ref: 00401593
                                                  • GdipGetImageHeight.GDIPLUS(?,?,?,?), ref: 004015F2
                                                  • GdipGetImageWidth.GDIPLUS(?,?,?,?,?,?), ref: 00401613
                                                  • GdipGetImagePaletteSize.GDIPLUS(?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0040165A
                                                  • GdipGetImagePalette.GDIPLUS(?,00000008,?,80070057,?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 004016CF
                                                  • GdipBitmapLockBits.GDIPLUS(?,?,00000001,?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 0040177B
                                                  • GdipBitmapUnlockBits.GDIPLUS(?,?,?,?,00000001,?,?,00000000,?,?,?,?,?,?,?,?), ref: 004017F1
                                                  • GdipCreateBitmapFromScan0.GDIPLUS(?,?,00022009,00022009,?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00401817
                                                  • GdipGetImageGraphicsContext.GDIPLUS(?,00000000,?,?,00022009,00022009,?,?,00000000,?,?,?,?,?,?,?), ref: 0040182D
                                                  • GdipDrawImageI.GDIPLUS(00000000,?,00000000,00000000,?,00000000,?,?,00022009,00022009,?,?,00000000,?,?,?), ref: 00401840
                                                  • GdipDeleteGraphics.GDIPLUS(00000000,00000000,?,00000000,00000000,?,00000000,?,?,00022009,00022009,?,?,00000000,?,?), ref: 00401846
                                                  • GdipDisposeImage.GDIPLUS(?,00000000,00000000,?,00000000,00000000,?,00000000,?,?,00022009,00022009,?,?,00000000,?), ref: 0040184C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Gdip$Image$Bitmap$BitsGraphicsPalette$ContextCreateDeleteDisposeDrawFormatFromHeightLockPixelScan0SizeUnlockWidth
                                                  • String ID: &$>=
                                                  • API String ID: 1279047860-1654677323
                                                  • Opcode ID: 34576b26573d57f11954caa93c89dd37f9b4685469006894c39224902bd046cc
                                                  • Instruction ID: 8a788743ff85fe53078408617ba339fa43619964413e8471535d34c3641ef31a
                                                  • Opcode Fuzzy Hash: 34576b26573d57f11954caa93c89dd37f9b4685469006894c39224902bd046cc
                                                  • Instruction Fuzzy Hash: 66A175B1E002059FDB14DF95D881AAFB7B5EF88304F14852EE919BB351D738E941CBA8
                                                  APIs
                                                  • CoInitialize.OLE32(00000000), ref: 004197EE
                                                  • CoCreateInstance.OLE32(0047D090,00000000,00000001,0047CFC0,?,?,?,00000000), ref: 00419812
                                                  • CoUninitialize.OLE32(?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,00475709,000000FF,0041DB54), ref: 0041981C
                                                  • CoSetProxyBlanket.OLE32(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00419894
                                                  • CoUninitialize.OLE32 ref: 004198B6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Uninitialize$BlanketCreateInitializeInstanceProxy
                                                  • String ID: Caption$SELECT * from Win32_Volume$WQL
                                                  • API String ID: 3575674281-2330458756
                                                  • Opcode ID: eaf92b9f431350d046898c36b2279287ac79430c6c025d09f53a85bfcf413d8d
                                                  • Instruction ID: d51c13efc7a02c32f90284d818f56e509f551fc104d77d5da5b0aeb1152a1774
                                                  • Opcode Fuzzy Hash: eaf92b9f431350d046898c36b2279287ac79430c6c025d09f53a85bfcf413d8d
                                                  • Instruction Fuzzy Hash: 10A189766083449FC300EF59C890A9BB7E9EF88354F10491EF44997360D779ED89CBA5
                                                  APIs
                                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,00000328,?,00000000), ref: 00453F69
                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00453FDE
                                                  • DeviceIoControl.KERNEL32(00000000,0009006F,?,00000008,00000000,?,?,00000000), ref: 00454016
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004542BB,?,00000328,00000000,00000000), ref: 00454026
                                                  • DeviceIoControl.KERNEL32(00000000,0009006F,?,00000008,00000000,?,?,00000000), ref: 00454057
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004542BB,?,00000328), ref: 00454066
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004542BB,?), ref: 00454071
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,004542BB,?,00000328), ref: 004540A7
                                                  • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,004542BB,?,00000328), ref: 004540D7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$ControlDeviceErrorLast$CreateDiskFileFreeSpace
                                                  • String ID: C:\$\\.\C:
                                                  • API String ID: 4273481478-2866759028
                                                  • Opcode ID: 34a5edf5a5058048d5bcc646d78f8edc09eed289d58a581d59fe32c4679fd1ad
                                                  • Instruction ID: dcbbcf768856184cb3fb00598b231148ced9fb8d52ef67d3d26bd90cee913ac4
                                                  • Opcode Fuzzy Hash: 34a5edf5a5058048d5bcc646d78f8edc09eed289d58a581d59fe32c4679fd1ad
                                                  • Instruction Fuzzy Hash: CA616C72608300AFC310DF69D88196BF7E4FFD8711F804A2EF55987291EB759848CB96
                                                  APIs
                                                  • IsWindow.USER32(004216E9), ref: 00422459
                                                  • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 004224AE
                                                  • SendMessageW.USER32(?,00000402,00000000,00000000), ref: 004224E0
                                                  • SetTimer.USER32(004216E9,00000001,000003E8,00000000), ref: 0042250F
                                                  • SendMessageW.USER32(?,00000401,00008004,00000000), ref: 00422558
                                                  • SendMessageW.USER32(?,00000401,00008013,00000000), ref: 0042256D
                                                  • SendMessageW.USER32(?,00000401,00008007,00000000), ref: 00422582
                                                  • SendMessageW.USER32(?,00000401,0000800C,00000000), ref: 00422597
                                                  • SetTimer.USER32(004216E9,00000064,00000064,00000000), ref: 004225A3
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$Timer$Window
                                                  • String ID:
                                                  • API String ID: 389327760-0
                                                  • Opcode ID: cefa6ec459511810d8e63057cbdb1cbfc242c52f6ba306b658606e850e188aac
                                                  • Instruction ID: a9acc03ce2714c2a1218ac3b36ef8cf29172f02598394e016a1efff805efb144
                                                  • Opcode Fuzzy Hash: cefa6ec459511810d8e63057cbdb1cbfc242c52f6ba306b658606e850e188aac
                                                  • Instruction Fuzzy Hash: 7C516170390B00ABE624EB75CC82FD6B395AF44B04F40851DB359AB2D1CBF6B8418B48
                                                  APIs
                                                  • GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00453C29
                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00453C9B
                                                  • DeviceIoControl.KERNEL32(00000000,0009006F,?,00000008,00000000,?,?,00000000), ref: 00453CD3
                                                  • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0045B451), ref: 00453CE3
                                                  • DeviceIoControl.KERNEL32(00000000,0009006F,?,00000008,00000000,?,?,00000000), ref: 00453D14
                                                  • GetLastError.KERNEL32 ref: 00453D23
                                                  • CloseHandle.KERNEL32(00000000), ref: 00453D2E
                                                  • CloseHandle.KERNEL32(00000000), ref: 00453D64
                                                  • CloseHandle.KERNEL32(00000000), ref: 00453D94
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$ControlDeviceErrorLast$CreateDiskFileFreeSpace
                                                  • String ID: \\.\C:
                                                  • API String ID: 4273481478-259948872
                                                  • Opcode ID: 8e78b7cc2f513fe7d2c87c6db2ff1183afca98e5cf5369f87d1bb03e29eba4d3
                                                  • Instruction ID: dfc82fb44819188d5703bd29b0abfd43a93b53b36df828bf3752750fb228464b
                                                  • Opcode Fuzzy Hash: 8e78b7cc2f513fe7d2c87c6db2ff1183afca98e5cf5369f87d1bb03e29eba4d3
                                                  • Instruction Fuzzy Hash: 58518C72608300ABC314DF69DC819AFF7F4EFC4751F804A2EF55982291EB7599088B9A
                                                  APIs
                                                  • CopyRect.USER32(?,?), ref: 0040ED30
                                                  • CreateCompatibleDC.GDI32(?), ref: 0040EDD3
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040EDF9
                                                  • BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 0040EE67
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0040EE77
                                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0040EEEE
                                                  • CopyRect.USER32(?,?), ref: 0040EF77
                                                  • SetRect.USER32(?,?,?,?,?), ref: 0040EFD9
                                                  • SetRect.USER32(?,?,?,?,?), ref: 0040F00C
                                                  • BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 0040F073
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Rect$CompatibleCopyCreateMessageSend$Bitmap
                                                  • String ID:
                                                  • API String ID: 2897418849-3916222277
                                                  • Opcode ID: 918371f1e30a1611824c586b15503814f3483ab0998594baaaceeb4de49a5514
                                                  • Instruction ID: af6e71f7250828e30cc2f680655b832ce69016c02ffdd7eabd90966ae28b2504
                                                  • Opcode Fuzzy Hash: 918371f1e30a1611824c586b15503814f3483ab0998594baaaceeb4de49a5514
                                                  • Instruction Fuzzy Hash: 5FC1F3B11083419FC324CF69C984B6BBBE9FF88704F108A2EF59993290DB74E945CB56
                                                  APIs
                                                  • LoadMenuW.USER32(00000000), ref: 00425C5A
                                                  • GetSubMenu.USER32(?,00000003), ref: 00425C85
                                                  • CheckMenuItem.USER32(?,00008029,00000008), ref: 00425DAB
                                                  • GetWindowRect.USER32(?,00000088), ref: 00425DBD
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Menu$CheckItemLoadRectWindow
                                                  • String ID: 1003007$1003008$1003009$1003010$3401095$DefragFinish$DiskDefrag
                                                  • API String ID: 64815558-1687404023
                                                  • Opcode ID: 123127c2d0aaff9ca1f9c8155f7220838f72c6e02ebb3a973c8be0f635bd4d16
                                                  • Instruction ID: 4418ca87599e6f793fb4d10bf028e48e6936bb9db45e74f47fa123fcf7e21ce3
                                                  • Opcode Fuzzy Hash: 123127c2d0aaff9ca1f9c8155f7220838f72c6e02ebb3a973c8be0f635bd4d16
                                                  • Instruction Fuzzy Hash: 2151CAB1794701BAE350AB609C47FAB7268AB84B14F10C91FB75EB65C0CEFCA405875D
                                                  APIs
                                                  • SendMessageW.USER32(?,00000405,00000001,00000000), ref: 004159AA
                                                  • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00415AB2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402005$3402065$3402067$3402068$3402069$3402070$3402071$3402072$3402084
                                                  • API String ID: 3850602802-328498535
                                                  • Opcode ID: 19e8cdb6f5ee6091fff7530154948aa3e76a5209e14532d290abc9f16ea37a07
                                                  • Instruction ID: 1067327c746e147da740696a904bc1cbb70a89f86cbb7c2e495eb833b01c89ea
                                                  • Opcode Fuzzy Hash: 19e8cdb6f5ee6091fff7530154948aa3e76a5209e14532d290abc9f16ea37a07
                                                  • Instruction Fuzzy Hash: 36413CF0B907407AD260AF618D43FEA3268AF84F04F60C42FB70E765D1CAEC6905969D
                                                  APIs
                                                  • SendMessageW.USER32(?,00001037,00000000,00000000), ref: 00417F45
                                                  • SendMessageW.USER32(?,00001036,00000000,00000000), ref: 00417F5B
                                                  • SendMessageW.USER32(0047D9D0,00001001,00000000,?), ref: 0041804D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3401074$3401075$3401076$3401077$8<$DiskDefrag$Mid_Back_Color$Window
                                                  • API String ID: 3850602802-2758692112
                                                  • Opcode ID: a8722d59c07b94f6922f7548e3e672599eeab7783c23535719575370a0de5a5f
                                                  • Instruction ID: 56ac88722a8962ac1f975558d68bc042bced7a88e006b99efbc398d4c5261ff8
                                                  • Opcode Fuzzy Hash: a8722d59c07b94f6922f7548e3e672599eeab7783c23535719575370a0de5a5f
                                                  • Instruction Fuzzy Hash: B23156B07903007AE274EB258C83FEA72659F44B14F20452FB71E762D1CEF97844565C
                                                  APIs
                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 0042C6CB
                                                    • Part of subcall function 0042D010: SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0042D041
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: InvalidateMessageRectSend
                                                  • String ID: 3401007$3401034$3401035$8<$DiskDefrag$Frame_Color$Mid_Back_Color$Text_Color$Window$Window_Back_Gray_Color
                                                  • API String ID: 909852535-1675042175
                                                  • Opcode ID: 52757a301fae08faaa59b090e491993efb51acdf8729a0a5be35b6fc276aefa4
                                                  • Instruction ID: 43899c4dce7d941302b132538349e8bcafe351e88f225ab48a7149cde0acca41
                                                  • Opcode Fuzzy Hash: 52757a301fae08faaa59b090e491993efb51acdf8729a0a5be35b6fc276aefa4
                                                  • Instruction Fuzzy Hash: BD316F707907017BD260BAB58C43FEA76A4AF84B04F20891BB65EB75C1CAF874419B9C
                                                  APIs
                                                  • CoInitialize.OLE32(00000000), ref: 00451CBB
                                                  • CoCreateInstance.OLE32(0047D360,00000000,00000001,0047D170,?), ref: 00451CDF
                                                  • VariantInit.OLEAUT32(?), ref: 00451CF8
                                                  • VariantInit.OLEAUT32(?), ref: 00451D24
                                                  • VariantInit.OLEAUT32(?), ref: 00451D4B
                                                  • VariantInit.OLEAUT32(?), ref: 00451D72
                                                  • VariantClear.OLEAUT32(?), ref: 00451E17
                                                  • VariantClear.OLEAUT32(?), ref: 00451E1E
                                                  • VariantClear.OLEAUT32(?), ref: 00451E25
                                                  • VariantClear.OLEAUT32 ref: 00451E37
                                                  • SysAllocString.OLEAUT32(0047EF4C), ref: 00451E69
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00451EA8
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Variant$ClearInit$String$AllocCreateFreeInitializeInstance
                                                  • String ID:
                                                  • API String ID: 162617764-0
                                                  • Opcode ID: 60d459dc24a125815d5dafe60fd6d4b8e488a7a08734036bff8a68fe5d906ce4
                                                  • Instruction ID: 4a3acebe906db87488b43d3aef87afcda0e18f97818647458927d115f12b3f92
                                                  • Opcode Fuzzy Hash: 60d459dc24a125815d5dafe60fd6d4b8e488a7a08734036bff8a68fe5d906ce4
                                                  • Instruction Fuzzy Hash: 08712875A183509FC310CF68C844A5ABBE8FF89B20F158A5EF99897360D775E804CF92
                                                  APIs
                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0042FE87
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                    • Part of subcall function 00419480: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 0041948D
                                                  • SendMessageW.USER32(?,0000100C,?,00000002), ref: 0042FF25
                                                  • SendMessageW.USER32(?,000083FE,?,?), ref: 0042FF79
                                                  • SendMessageW.USER32(?,0000100C,?,00000002), ref: 0042FFF3
                                                  • SendMessageW.USER32(?,0000100C,?,00000002), ref: 00430097
                                                    • Part of subcall function 00403D70: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00403D7D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$CriticalEnterSection
                                                  • String ID: /e,/select,"%s%s"$explorer.exe$open
                                                  • API String ID: 2245208738-2061274879
                                                  • Opcode ID: 6084d6d9c31c5e8e87111b28fc1d81106313e61976c66e0b3451886aebb16f9e
                                                  • Instruction ID: 422179ffa12990fac143fec7e91d506efcaf28af02f31003f6d515ad2e321b24
                                                  • Opcode Fuzzy Hash: 6084d6d9c31c5e8e87111b28fc1d81106313e61976c66e0b3451886aebb16f9e
                                                  • Instruction Fuzzy Hash: 1AC1C4312043008BC710EF24D995B9BB7F5BF88704F500A6EF9499B296DB74ED49CB9A
                                                  APIs
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0040FD1F
                                                  • GetObjectW.GDI32(?,0000005C,?), ref: 0040FD37
                                                  • GetClientRect.USER32(?,?), ref: 0040FD46
                                                  • SendMessageW.USER32(?,00001200,00000000,00000000), ref: 0040FDC3
                                                  • GetCursorPos.USER32(?), ref: 0040FE29
                                                  • ScreenToClient.USER32(?,?), ref: 0040FE38
                                                  • SendMessageW.USER32(?,0000120F,?,00000000), ref: 0040FE6C
                                                  • SendMessageW.USER32(?,0000120B,00000000,?), ref: 0040FE82
                                                  • RectVisible.GDI32(?,?), ref: 0040FEAC
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$ClientRect$CursorObjectScreenVisible
                                                  • String ID: d
                                                  • API String ID: 883400287-2564639436
                                                  • Opcode ID: e58942ff4a5daa3b07d53de4812bd48be39c791cdb0435b4f276cefe3218f9a6
                                                  • Instruction ID: e57791d17a927b35fa3e7b028ca1617c0da729b9688da5cd3a54cba97037c013
                                                  • Opcode Fuzzy Hash: e58942ff4a5daa3b07d53de4812bd48be39c791cdb0435b4f276cefe3218f9a6
                                                  • Instruction Fuzzy Hash: CB8119B11083819FD325DF65C984F9BB7E8FF88704F004A2DF58997291EB74A944CB96
                                                  APIs
                                                  • GetClientRect.USER32(?,?), ref: 0042DA84
                                                  • CreateCompatibleDC.GDI32(?), ref: 0042DAAE
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0042DAD4
                                                  • SelectObject.GDI32(?,?), ref: 0042DAF2
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0042DB00
                                                  • FillRect.USER32(?,?,?), ref: 0042DB38
                                                  • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 0042DBBE
                                                  Strings
                                                  • ColorIndex, xrefs: 0042DA3E
                                                  • DiskDefrag\Setting Option\Gereral\DefragColor, xrefs: 0042DA43
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CompatibleCreateRect$BitmapClientFillMessageObjectSelectSend
                                                  • String ID: ColorIndex$DiskDefrag\Setting Option\Gereral\DefragColor
                                                  • API String ID: 24576784-1631410767
                                                  • Opcode ID: 413f7938cfa32640085c5d27a34cebb069bf0ab9b2ff2f1bc307b4aa97a93b27
                                                  • Instruction ID: 821a5ab27c6a8f9e6b02cc0ac72b1b3995420b0d805852c9f35119affff3cd9f
                                                  • Opcode Fuzzy Hash: 413f7938cfa32640085c5d27a34cebb069bf0ab9b2ff2f1bc307b4aa97a93b27
                                                  • Instruction Fuzzy Hash: F2617EB1608340AFC304DF68D884E5BB7E8FF88714F408A2EF59997291DB74E944CB96
                                                  APIs
                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00456B14
                                                    • Part of subcall function 00454290: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00454306
                                                  • CloseHandle.KERNEL32(00000000,00000000), ref: 00456B57
                                                  • CloseHandle.KERNEL32 ref: 00456B7E
                                                  • CloseHandle.KERNEL32 ref: 00456BA5
                                                  • CloseHandle.KERNEL32(?,?,?,00000000,00000000), ref: 00456BD6
                                                  • CloseHandle.KERNEL32(?,?,?,00000001,00000000), ref: 00456C07
                                                  • CloseHandle.KERNEL32(?,?,?,00000001,00000001), ref: 00456C38
                                                  • CloseHandle.KERNEL32(00000000), ref: 00456C5F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle$CreateFileUnothrow_t@std@@@__ehfuncinfo$??2@
                                                  • String ID: \\.\C:
                                                  • API String ID: 1066634676-259948872
                                                  • Opcode ID: 39a1f70db7202d3b1c3ce52b526e9e0b0aae69084ae2661cf5f3dced9512c8e9
                                                  • Instruction ID: 9c2aacaccead671dbc3a96f70d0e1eab3c71fbf61e1a23b3dd7d7caf89dd1f7c
                                                  • Opcode Fuzzy Hash: 39a1f70db7202d3b1c3ce52b526e9e0b0aae69084ae2661cf5f3dced9512c8e9
                                                  • Instruction Fuzzy Hash: C75109377043006BD214AF69AC86BAEB394EF9C725F80013FF509D3282DA255548C7AB
                                                  APIs
                                                  • LoadMenuW.USER32(00000000), ref: 004228FF
                                                  • GetSubMenu.USER32(00000004,00000000), ref: 0042292A
                                                  • GetCursorPos.USER32(B7F9C0F2), ref: 00422945
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Menu$CursorLoad
                                                  • String ID: 3401032$3401033$3401086$3401087$3401088$[SSD]
                                                  • API String ID: 3043871728-3947735280
                                                  • Opcode ID: 352b6fe1555d07d765fb6c3e069cc21c0751bafc0a472c981a3ba47c817ac479
                                                  • Instruction ID: c9e3dbd840687df198e490246c1b34f6b1a62d60348da21d10426e52b8988a23
                                                  • Opcode Fuzzy Hash: 352b6fe1555d07d765fb6c3e069cc21c0751bafc0a472c981a3ba47c817ac479
                                                  • Instruction Fuzzy Hash: 1B4196F17543006AD764EB64DC42F9F72A8AF84B10F20C91FB65EA26C0CEBC640547AD
                                                  APIs
                                                  • SendMessageW.USER32(?,00001037,00000000,00000000), ref: 0042EAE3
                                                  • SendMessageW.USER32(?,00001036,00000000,00000000), ref: 0042EAF7
                                                  • SendMessageW.USER32(?,0000101E,00000000,0000FFFE), ref: 0042EB36
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402007$3402033$3402037$3402038$3402039$3402040
                                                  • API String ID: 3850602802-3173017236
                                                  • Opcode ID: 6cbccfbbc1fd63c8a78153f1b809b30710d94fdfea326ecc7c254d81bae311d8
                                                  • Instruction ID: f302c9e8cacf912969436f53e573b816ab0f893bb8e7c3a9347613e7e3a9d812
                                                  • Opcode Fuzzy Hash: 6cbccfbbc1fd63c8a78153f1b809b30710d94fdfea326ecc7c254d81bae311d8
                                                  • Instruction Fuzzy Hash: 0021D7F0BE074035E6B5BA614D43FEE21295F84F49F20880BB75E7A9C2CADC3941629D
                                                  APIs
                                                  • SysFreeString.OLEAUT32(00000000), ref: 0045382E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: FreeString
                                                  • String ID:
                                                  • API String ID: 3341692771-0
                                                  • Opcode ID: f91c71cdff771b475ab66cf7fa24957df628f7f2d51a469e190cf7c95d6e8a29
                                                  • Instruction ID: be2023aef89e17b54fd3cfd96c880170c5f98da2cba37ae09b4ebda1ed5f38f7
                                                  • Opcode Fuzzy Hash: f91c71cdff771b475ab66cf7fa24957df628f7f2d51a469e190cf7c95d6e8a29
                                                  • Instruction Fuzzy Hash: 79C1F4B56083448FC310DF69C884A5BFBE9BFC9714F148A5EE9888B361C775E905CB92
                                                  APIs
                                                  • SendMessageW.USER32 ref: 0040F806
                                                  • SendMessageW.USER32(?,00001215,00000000,00000000), ref: 0040F82F
                                                  • CopyRect.USER32(?,?), ref: 0040F845
                                                  • SendMessageW.USER32(?,00001200,00000000,00000000), ref: 0040F876
                                                  • GetClientRect.USER32(?,?), ref: 0040F88B
                                                    • Part of subcall function 00407E20: CopyRect.USER32(?,?), ref: 00407F0C
                                                    • Part of subcall function 00407E20: CopyRect.USER32(?,?), ref: 00407F1E
                                                  • SendMessageW.USER32(?,00001209,00000000,00000000), ref: 0040F9EE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageRectSend$Copy$Client
                                                  • String ID: $6
                                                  • API String ID: 201260696-4183747533
                                                  • Opcode ID: 42de312bba28103fbd9c5fb933112db53f737e9031533f58468e5b08cd7e4db0
                                                  • Instruction ID: 8b216fbeb9dde18344444fa578b156f2309188772abd6b45e307a88af5c25f20
                                                  • Opcode Fuzzy Hash: 42de312bba28103fbd9c5fb933112db53f737e9031533f58468e5b08cd7e4db0
                                                  • Instruction Fuzzy Hash: C4E141B15083429FD320DF25C580A9BFBE9FF88704F004A2EF49997381D778A949CB96
                                                  APIs
                                                  • type_info::operator==.LIBVCRUNTIME ref: 005045EA
                                                  • ___TypeMatch.LIBVCRUNTIME ref: 005046F8
                                                  • CatchIt.LIBVCRUNTIME ref: 00504749
                                                  • _UnwindNestedFrames.LIBCMT ref: 0050484A
                                                  • CallUnexpected.LIBVCRUNTIME ref: 00504865
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
                                                  • String ID: csm$csm$csm
                                                  • API String ID: 4119006552-393685449
                                                  • Opcode ID: db6911eeb18ea0690dd3015614cb64c63f58b32e68444e165eea8de91f316cb1
                                                  • Instruction ID: 5dd21464bb712edaca5d39657731a3d44e727a7ea374a4dbe15693b69206165e
                                                  • Opcode Fuzzy Hash: db6911eeb18ea0690dd3015614cb64c63f58b32e68444e165eea8de91f316cb1
                                                  • Instruction Fuzzy Hash: 18B1ADB180020AEFCF14DFA4C8859AEBFB5FF45310F14855AEA156B292D331DA61CF91
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CopyRect
                                                  • String ID: Bottom$Left$Margin$Right$Top$`=$=
                                                  • API String ID: 1989077687-1885521073
                                                  • Opcode ID: 7228557bf4eec712440a2a01e2918a4b82bf569ecbcba635092fccc8b3479bc2
                                                  • Instruction ID: 7cbf7df4fec77659c91c3afac7ac99305081f53a3d300e0ff47080e44fb4b669
                                                  • Opcode Fuzzy Hash: 7228557bf4eec712440a2a01e2918a4b82bf569ecbcba635092fccc8b3479bc2
                                                  • Instruction Fuzzy Hash: 0EB166766043419FC310DF28C881B5BB7E8FB98704F148A2EF58A97391DB75E944CB9A
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • SendMessageW.USER32(?,0000102F,00000000,00000000), ref: 004187CD
                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004187EF
                                                  • SendMessageW.USER32(?,00001027,00000000,00000000), ref: 0041899B
                                                  • SendMessageW.USER32(?,00001028,00000000,00000000), ref: 004189AF
                                                  • SendMessageW.USER32(?,00001027,00000000,00000000), ref: 004189C5
                                                  • SendMessageW.USER32(?,00001015,00000000,?), ref: 004189DB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$CriticalEnterSection
                                                  • String ID: %.2f%%$%I64u
                                                  • API String ID: 2245208738-2288124401
                                                  • Opcode ID: e8a4837ba97be504fd883f7b81f214d570e02bb173e6daae76494a95ea94b1e9
                                                  • Instruction ID: e1e33ad56b98f5e84924c458d64c7c6c02eb77d82da0e984fc61a5a5d3d1ca0d
                                                  • Opcode Fuzzy Hash: e8a4837ba97be504fd883f7b81f214d570e02bb173e6daae76494a95ea94b1e9
                                                  • Instruction Fuzzy Hash: 9EA16E71304201AFD368EB24CD85FAFB7B9AF88704F40491EF64697291DBB4AC45CB5A
                                                  APIs
                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00418B07
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                    • Part of subcall function 00419480: SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 0041948D
                                                  • SendMessageW.USER32(?,0000100C,?,00000002), ref: 00418BA8
                                                  • SendMessageW.USER32(?,000083FE,?,?), ref: 00418BF6
                                                    • Part of subcall function 00403D70: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00403D7D
                                                  • SendMessageW.USER32(?,0000102C,00000000,00000003), ref: 00418C9F
                                                    • Part of subcall function 00419460: SendMessageW.USER32(?,0000100C,?,00000002), ref: 00419470
                                                  • ShellExecuteW.SHELL32(?,open,explorer.exe,?,00000000,00000001), ref: 00418D51
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$CriticalEnterExecuteSectionShell
                                                  • String ID: /e,/select,"%s%s"$explorer.exe$open
                                                  • API String ID: 206244367-2061274879
                                                  • Opcode ID: a5fa7ea55bf9bde6b0bb0cbb934ee9a0175d398fdb301d4cbe7f43ab10112c1d
                                                  • Instruction ID: 9e016845d88e4024dd1218f79a327356caeee79904b42a6c0a28c628b7da3379
                                                  • Opcode Fuzzy Hash: a5fa7ea55bf9bde6b0bb0cbb934ee9a0175d398fdb301d4cbe7f43ab10112c1d
                                                  • Instruction Fuzzy Hash: 2691E0712047009BD710EF24DD85FDAB7E5BF98704F00092EF945AB286DB78E945CBAA
                                                  APIs
                                                  • SendMessageW.USER32(?,0000133D,00000000,00000001), ref: 0042CE5B
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105,?,B7F9C0F2,?,?,?,?,?,?,?,?,?,004217B6), ref: 0042CEBD
                                                  • SendMessageW.USER32(?,00001304,00000000,00000000), ref: 0042CEF4
                                                  • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0042CF49
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$RedrawWindow
                                                  • String ID: %s (%c:)$%s (%s)$3401034$3401126
                                                  • API String ID: 648961319-3732436656
                                                  • Opcode ID: e1afdf9b5f9a6a0a3f1bdb0e24b03c0913b1775ab901b2b3f138c93be5904649
                                                  • Instruction ID: fd74af85edc4f78d52bbe53b36b76dc0b3b7e67d0ab5ffb778a9a62391dde0ea
                                                  • Opcode Fuzzy Hash: e1afdf9b5f9a6a0a3f1bdb0e24b03c0913b1775ab901b2b3f138c93be5904649
                                                  • Instruction Fuzzy Hash: 0E718D716043409FD324DF64DD85FABBBF4EF88700F10492EFA5A96290DBB4A944CB5A
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(ntdll,NtQuerySystemInformation), ref: 00419B01
                                                  • GetProcAddress.KERNEL32(00000000), ref: 00419B08
                                                  • QueryPerformanceFrequency.KERNEL32(00497F28), ref: 00419C49
                                                  • QueryPerformanceCounter.KERNEL32(00497F30), ref: 00419C54
                                                  • QueryPerformanceCounter.KERNEL32(?), ref: 00419C70
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00419C9C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: PerformanceQuery$Counter$AddressFrequencyHandleModuleProcUnothrow_t@std@@@__ehfuncinfo$??2@
                                                  • String ID: NtQuerySystemInformation$ntdll
                                                  • API String ID: 3025674679-3593917365
                                                  • Opcode ID: 3125494ca8bbf67271106e3f1c2de1996966a1ae5acd7d052624fdc1ffea64cd
                                                  • Instruction ID: d06557f50192d5db3270ba6b6212bac26de826900838c4c68c4281c4e513f8d9
                                                  • Opcode Fuzzy Hash: 3125494ca8bbf67271106e3f1c2de1996966a1ae5acd7d052624fdc1ffea64cd
                                                  • Instruction Fuzzy Hash: AF518F71B1C301ABD7149F11FD55AAA37E4FB98780F108C3EE585A2268FB3499418BDD
                                                  APIs
                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0042CAB6
                                                  • IsWindowVisible.USER32(?), ref: 0042CAE7
                                                  • GetParent.USER32(?), ref: 0042CB0D
                                                  • SendNotifyMessageW.USER32(?,000083FF,00000000,00000000), ref: 0042CB22
                                                  • IsWindowVisible.USER32(?), ref: 0042CB35
                                                  • GetParent.USER32(?), ref: 0042CB43
                                                  • SendNotifyMessageW.USER32(?,000083FF,00000000,00000000), ref: 0042CB58
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$NotifyParentVisibleWindow
                                                  • String ID: `=
                                                  • API String ID: 2910063261-2762138152
                                                  • Opcode ID: a16c229816da6b7cf5f0a28e1e2d3aecd927b3af40c0253dbdebf6034a51f9bf
                                                  • Instruction ID: cbd818397c052fadd252f380dd8efe1df66f27c17fa2dba641e1c387511c7e9b
                                                  • Opcode Fuzzy Hash: a16c229816da6b7cf5f0a28e1e2d3aecd927b3af40c0253dbdebf6034a51f9bf
                                                  • Instruction Fuzzy Hash: B0511030764700ABE224EF31DDD6FEA7394BB50B04F90842EB25F9A1D19FA47944CB99
                                                  APIs
                                                  • GetWindowRect.USER32(?,B7F9C0F2), ref: 00421BFF
                                                  • GetCursorPos.USER32(?), ref: 00421C0A
                                                  • LoadMenuW.USER32(00000000), ref: 00421C48
                                                  • GetSubMenu.USER32(?,00000001), ref: 00421C73
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Menu$CursorLoadRectWindow
                                                  • String ID: 3401014$3401015$3401098$3401131
                                                  • API String ID: 539701409-459607355
                                                  • Opcode ID: 74e98f2b8f7e0c57ba0c6132b3f1f176a4006ac73c5a262d0c7a288982427452
                                                  • Instruction ID: aabc8bb0dc6c93bda9c7aa98bf8ca1edfc519584f33f3993db52bfb4b78a6ed8
                                                  • Opcode Fuzzy Hash: 74e98f2b8f7e0c57ba0c6132b3f1f176a4006ac73c5a262d0c7a288982427452
                                                  • Instruction Fuzzy Hash: 6A41B6B17543406AD324AB65DC42FAF73A8AF84B14F108A1FB65EA26C0CE7CA405879D
                                                  APIs
                                                  • SendMessageW.USER32(?,00000172,00000000,?), ref: 004027B1
                                                  • SendMessageW.USER32(?,00000172,00000000,?), ref: 00402863
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402041$3402042$DiskDefrag$Images$close$open
                                                  • API String ID: 3850602802-3786962624
                                                  • Opcode ID: cdc453c516630b020ec0cec2833834f757ecf7b414e406f0a32de656b7e70e72
                                                  • Instruction ID: 8150cbd10707325bb4a07bc8764e9056bc1ba0aa629cfab9f1adae748ae802a6
                                                  • Opcode Fuzzy Hash: cdc453c516630b020ec0cec2833834f757ecf7b414e406f0a32de656b7e70e72
                                                  • Instruction Fuzzy Hash: F8319EB579020027D61576254EA6FBE21661FC4B48F25C22FB30E7B3C2DEED9C41429E
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ActiveMessageWindow
                                                  • String ID: 3400001$3400101$3401090$rY
                                                  • API String ID: 3610105657-3605576623
                                                  • Opcode ID: b7d0b320c8ac4bba339029e9d88ce301a028bf10c8a73a5048825e82f1bb1e34
                                                  • Instruction ID: 7aa1b3021184ad304fb6d47c852e9f0d985907e1382866191d812cb31a89d144
                                                  • Opcode Fuzzy Hash: b7d0b320c8ac4bba339029e9d88ce301a028bf10c8a73a5048825e82f1bb1e34
                                                  • Instruction Fuzzy Hash: 872179F0A50301BBD7106BB49C4AB9A31A8AF54701F50C82BB50EE1550D7BCA8449B6D
                                                  APIs
                                                  • SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00416BBB
                                                  • GetCursorPos.USER32(?), ref: 00416BCF
                                                  • ScreenToClient.USER32(?,?), ref: 00416BDE
                                                  • SendMessageW.USER32(?,00000198,00000000,?), ref: 00416BFF
                                                  • PtInRect.USER32(?,?,?), ref: 00416C10
                                                  • SendMessageW.USER32(?,00000198,?,?), ref: 00416C74
                                                  • InvalidateRect.USER32(?,?,00000001), ref: 00416C87
                                                  • PtInRect.USER32(?,?,?), ref: 00416C98
                                                  • InvalidateRect.USER32(?), ref: 00416CC7
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Rect$MessageSend$Invalidate$ClientCursorScreen
                                                  • String ID:
                                                  • API String ID: 2454936240-0
                                                  • Opcode ID: 41846961993d4e238d2a253bad1eeefc775d047419a5e1f45b38c98fcc342d77
                                                  • Instruction ID: e3b87b86549111153a689a6de42a5e443b1792048b086b4c3e38e8d95830a062
                                                  • Opcode Fuzzy Hash: 41846961993d4e238d2a253bad1eeefc775d047419a5e1f45b38c98fcc342d77
                                                  • Instruction Fuzzy Hash: B3413BB1208301AFC310DF65D884EABB7E9FBC8710F004A2EF59987250E775E945CBA6
                                                  APIs
                                                  • CopyRect.USER32(?,?), ref: 004318DA
                                                  • FrameRect.USER32(?,?,00000000), ref: 004319AA
                                                  • CreateCompatibleDC.GDI32(?), ref: 00431B90
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00431BCE
                                                  • SelectObject.GDI32(?,?), ref: 00431BEF
                                                  • AlphaBlend.MSIMG32(?,?,?,?,00000003,?,00000000,00000000,?,00000003,00000000,00000000,00000000,?,?,00F0F0F0), ref: 00431C5D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CompatibleCreateRect$AlphaBitmapBlendCopyFrameObjectSelect
                                                  • String ID: Z
                                                  • API String ID: 54210234-1505515367
                                                  • Opcode ID: 5f029b77f6b4eb3bbc3495fe3d68357bdf896ac53e414383373f8e8c30d0e72a
                                                  • Instruction ID: 0792d4e533d00b1b26a73fc7749f663e28f4755597dc11c0d4e9561af80c2fe6
                                                  • Opcode Fuzzy Hash: 5f029b77f6b4eb3bbc3495fe3d68357bdf896ac53e414383373f8e8c30d0e72a
                                                  • Instruction Fuzzy Hash: 3DC112716083418FC724DF69C984A5BBBE5AFC8704F108A2EF58987391DB74E909CB96
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 3401059$3401060$3401061$3401062$<a>%s</a>
                                                  • API String ID: 0-135031447
                                                  • Opcode ID: 1d18fe7b7d33c6ca33f908e1a40e0b7338c7c8696b9367286f1202db6d62bc10
                                                  • Instruction ID: 570f8eb3785bc855bef0c474daa2501289258084391a13b0a6423d05570a55ca
                                                  • Opcode Fuzzy Hash: 1d18fe7b7d33c6ca33f908e1a40e0b7338c7c8696b9367286f1202db6d62bc10
                                                  • Instruction Fuzzy Hash: 3D81D7717543005BC714EF218C42BDA33A4AF88714F14853FBA0D6B2C6DBB9E985879E
                                                  APIs
                                                    • Part of subcall function 004012D0: EnterCriticalSection.KERNEL32 ref: 00401305
                                                    • Part of subcall function 004012D0: LeaveCriticalSection.KERNEL32(00497DC0), ref: 00401316
                                                    • Part of subcall function 004650D0: GetDC.USER32(00000000), ref: 004650D8
                                                    • Part of subcall function 004650D0: GetDeviceCaps.GDI32(00000000,00000008), ref: 004650E9
                                                    • Part of subcall function 004650D0: GetDeviceCaps.GDI32(00000000,0000000A), ref: 004650F0
                                                    • Part of subcall function 004650D0: GetDeviceCaps.GDI32(00000000,00000058), ref: 004650F9
                                                    • Part of subcall function 004650D0: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00465108
                                                    • Part of subcall function 004650D0: ReleaseDC.USER32(00000000,00000000), ref: 0046512C
                                                  • GetSysColor.USER32(0000000F), ref: 00465580
                                                  • SetRect.USER32 ref: 004655DE
                                                  • SetRect.USER32(?,00000005,00000000,00000005,00000000), ref: 004655ED
                                                  • CreateFontW.GDI32(0000000E,00000000,00000000,00000000,00000190,00000000,00000000,00000000,00000000,00000000,00000000,00000004,00000000,Arial), ref: 00465611
                                                  • GdiplusStartup.GDIPLUS(?,?,?,00000000,?,?,?,?,?,?,00000005,00000000,00000005,00000000,?,00000000), ref: 00465655
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CapsDevice$CriticalRectSection$ColorCreateEnterFontGdiplusLeaveReleaseStartup
                                                  • String ID: 8<$Arial
                                                  • API String ID: 3457378621-1936108657
                                                  • Opcode ID: 21f298834923a9129a73d245b656ce22499d11a29d2306eb1dda716370a173d4
                                                  • Instruction ID: b865aa364f9357de02ae4fe0840df8cdec7f8c78b7ca9b09445c5b8d1f81986b
                                                  • Opcode Fuzzy Hash: 21f298834923a9129a73d245b656ce22499d11a29d2306eb1dda716370a173d4
                                                  • Instruction Fuzzy Hash: ED8121B09057889EDB70DF2ACC44BCABBE8BF94714F00011FF8489A2A1DBB55604CF99
                                                  APIs
                                                    • Part of subcall function 004298F0: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000004FF), ref: 00429964
                                                    • Part of subcall function 004298F0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0042998F
                                                    • Part of subcall function 004298F0: TranslateMessage.USER32(?), ref: 0042999A
                                                    • Part of subcall function 004298F0: DispatchMessageW.USER32(?), ref: 004299A1
                                                    • Part of subcall function 004298F0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004299B0
                                                    • Part of subcall function 004298F0: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000004FF), ref: 004299C9
                                                  • SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00424612
                                                    • Part of subcall function 00424C20: SendMessageW.USER32(?,000010A9,?,00000000), ref: 00424C61
                                                    • Part of subcall function 00424C20: SetForegroundWindow.USER32(?), ref: 00424C6D
                                                  • PostMessageW.USER32(?,00000111,00000001,00000000), ref: 0042452F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Message$MultipleObjectsPeekSendWait$DispatchForegroundPostTranslateWindow
                                                  • String ID: "RightMenuDisk"$"RightMenuFile"$-AutoDefragmention$-BootTimeDefrag$ScheduleStart
                                                  • API String ID: 784092869-278688185
                                                  • Opcode ID: dc55257c4458ac874c86a61cc18cc1c17bee00782c775f5169f385f524cd433c
                                                  • Instruction ID: c97898347ab5420be132615685895ca4f66fbeb7c47801a8b84119e28bf46611
                                                  • Opcode Fuzzy Hash: dc55257c4458ac874c86a61cc18cc1c17bee00782c775f5169f385f524cd433c
                                                  • Instruction Fuzzy Hash: E251C431304310AFC300EF15EDC5A6BB7E4EBD8755F84092EF54A92291DBB89988CB5A
                                                  APIs
                                                  • GetParent.USER32(?), ref: 00465A5F
                                                  • GetWindowRect.USER32(?,?), ref: 00465A78
                                                  • GetClientRect.USER32(?,?), ref: 00465B27
                                                  • GetDC.USER32(?), ref: 00465B49
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00465B61
                                                  • ReleaseDC.USER32(?,?), ref: 00465BA5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Rect$ClientMessageParentReleaseSendWindow
                                                  • String ID: Button_Check
                                                  • API String ID: 330964712-1860365581
                                                  • Opcode ID: aafe33e43f13557e9fd3d95a85fa062db54e1fb928152b145d4fd0b75ee94390
                                                  • Instruction ID: b1a5f572caf67006923a9ef52c219ce68de25ddbd2c2a7f7615237fc757273c6
                                                  • Opcode Fuzzy Hash: aafe33e43f13557e9fd3d95a85fa062db54e1fb928152b145d4fd0b75ee94390
                                                  • Instruction Fuzzy Hash: D0510371600B019FD324DF79C889BA7B3E9BF88704F008A1DE5AA97281DB74B854CF59
                                                  APIs
                                                  • GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,0000000C,00000000), ref: 004557C8
                                                  • GetDiskFreeSpaceW.KERNEL32 ref: 00455855
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DiskFreeInformationSpaceVolume
                                                  • String ID: C:\$FAT$FAT16$FAT32$NTFS
                                                  • API String ID: 3270478670-3579686192
                                                  • Opcode ID: f0af46782a5a30f8442838258ae9688fef8f3122b442d05ec30af96031f478ec
                                                  • Instruction ID: 9d95486116a49aac5a83eb76fc3575ce500acb11c4e489ecfb74c34df7f4e439
                                                  • Opcode Fuzzy Hash: f0af46782a5a30f8442838258ae9688fef8f3122b442d05ec30af96031f478ec
                                                  • Instruction Fuzzy Hash: 65316071A183015BD714EF24DC52B7B7BE4AF88705F44492EF949D6290E638D508CB9B
                                                  APIs
                                                  • SendMessageW.USER32(?,00001037,00000000,00000000), ref: 0042F900
                                                  • SendMessageW.USER32(?,00001036,00000000,00000000), ref: 0042F916
                                                  • SendMessageW.USER32(?,00001001,00000000,?), ref: 0042FA08
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3401074$3401075$3401076$3401077
                                                  • API String ID: 3850602802-1879149864
                                                  • Opcode ID: c4bce1112986585be18b77c07089e63f6cda37178a12ed3d6a88cb22f3d1e080
                                                  • Instruction ID: b1405050125067dfa2b98fefbbf4893992a49d55c405f1a2d248d2381da72ad7
                                                  • Opcode Fuzzy Hash: c4bce1112986585be18b77c07089e63f6cda37178a12ed3d6a88cb22f3d1e080
                                                  • Instruction Fuzzy Hash: 0D3168F07903007BE674EB258D83FEA72A59B44B54F20892FB71E762D1CAF87844965C
                                                  APIs
                                                  • GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,0000000C,00000000), ref: 00454A46
                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000), ref: 00454ABC
                                                  • DeviceIoControl.KERNEL32(00000000,00090064,00000000,00000000,00000340,00000060,00000003,00000000), ref: 00454AE8
                                                  • CloseHandle.KERNEL32(00000000), ref: 00454AFA
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseControlCreateDeviceFileHandleInformationVolume
                                                  • String ID: C:\$NTFS$\\.\C:
                                                  • API String ID: 1233574911-974996950
                                                  • Opcode ID: 0b712c942aafd56dc5bdacd96f40fd37a890dc6406218b81da3fa3882dbb5d1c
                                                  • Instruction ID: 7a7ffa21548745985fbbbea45252e330d1802da0f0ea7318edadfa9cc625902c
                                                  • Opcode Fuzzy Hash: 0b712c942aafd56dc5bdacd96f40fd37a890dc6406218b81da3fa3882dbb5d1c
                                                  • Instruction Fuzzy Hash: DE311D71608300AFE320CF64D885B6BB7F8AF88714F400A2DF549D7291E7B5E584CB5A
                                                  APIs
                                                  • SendMessageW.USER32(?,0000102F,?,00000000), ref: 0042D3DB
                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0042D3F8
                                                  • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0042D411
                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0042D433
                                                  • SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0042D46C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: Selected$`=
                                                  • API String ID: 3850602802-3404155819
                                                  • Opcode ID: 277d209018b5d9a8a410fc2a0ed1bbfc6736054aef52b9b75753d9dc20516a73
                                                  • Instruction ID: 47af735872212f4aff9019aaa9f39296bd56d2d945b6e3696df55891068cb05b
                                                  • Opcode Fuzzy Hash: 277d209018b5d9a8a410fc2a0ed1bbfc6736054aef52b9b75753d9dc20516a73
                                                  • Instruction Fuzzy Hash: 4521D8757407117BE230EB79ED82F9BA3A4AB48B55F504A1AF705A72C1CAB4F801879C
                                                  APIs
                                                  • SendMessageW.USER32(00000000,0000000B,00000000,00000000), ref: 00420AB8
                                                  • SendMessageW.USER32(?,0000101D,00000005,00000000), ref: 00420ACA
                                                  • SendMessageW.USER32(?,00001207,00000006,?), ref: 00420AE9
                                                  • GetClientRect.USER32(?,?), ref: 00420AFB
                                                  • SendMessageW.USER32(?,0000101E,00000005), ref: 00420B28
                                                  • SendMessageW.USER32(?,0000000B,00000001,00000000), ref: 00420B37
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$ClientRect
                                                  • String ID: Button_Check
                                                  • API String ID: 1925248871-1860365581
                                                  • Opcode ID: 2dbc91605b07778e48ee4b1ccc5bb52471f65858b054350958406698a8df70d5
                                                  • Instruction ID: f6960d58b42149bb48d8704757dd9bea0314272504ba79e98d6d7c5fe9983159
                                                  • Opcode Fuzzy Hash: 2dbc91605b07778e48ee4b1ccc5bb52471f65858b054350958406698a8df70d5
                                                  • Instruction Fuzzy Hash: EC115E717403057BE235EA79CC86FA773E9AB88B40F41491CF285EB1C1DAB9F9448B54
                                                  APIs
                                                  • SysFreeString.OLEAUT32(00000000), ref: 00453297
                                                  • SysAllocString.OLEAUT32(?), ref: 00453332
                                                  • VariantInit.OLEAUT32(?), ref: 004533BF
                                                  • VariantInit.OLEAUT32(?), ref: 004533E6
                                                  • SysFreeString.OLEAUT32(?), ref: 004534A6
                                                  • VariantClear.OLEAUT32(?), ref: 004534B7
                                                  • VariantClear.OLEAUT32(?), ref: 004534BE
                                                  • VariantClear.OLEAUT32(?), ref: 004534C5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Variant$ClearString$FreeInit$Alloc
                                                  • String ID:
                                                  • API String ID: 1906771560-0
                                                  • Opcode ID: e733c2cee5cbb5377ac2072c21b29c4e9d8b7a1ab7a7561ec9f277c12a0121fb
                                                  • Instruction ID: 04dbbea40edafa167825a5640816ee55d2e105094fff44b6784cacd96e044d36
                                                  • Opcode Fuzzy Hash: e733c2cee5cbb5377ac2072c21b29c4e9d8b7a1ab7a7561ec9f277c12a0121fb
                                                  • Instruction Fuzzy Hash: 47B136716083409FC310DF69C884A1BFBE9BFC9714F24895EE99887362D774E949CB92
                                                  APIs
                                                  • IsWindow.USER32(?), ref: 004181B6
                                                  • GetWindowRect.USER32(?,00000006), ref: 00418204
                                                  • GetWindowRect.USER32(?,000003FD), ref: 0041827F
                                                  • GetWindowRect.USER32(?,000003FD), ref: 004182FA
                                                  • GetClientRect.USER32(?,?), ref: 0041833E
                                                  • GetWindowRect.USER32(?,?), ref: 00418350
                                                  • SendMessageW.USER32(?,0000101E,00000003,0000FFFE), ref: 004183AA
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: RectWindow$ClientMessageSend
                                                  • String ID:
                                                  • API String ID: 1071774122-0
                                                  • Opcode ID: 81f35ccb1619ef2e815f8add3878e72e1f22e65b62a8cf288e8ccd6dbd741210
                                                  • Instruction ID: 3d1e85c786be0547c74fbf31f73b40b43d39c9eef0f0cab4dee81a64cc519da0
                                                  • Opcode Fuzzy Hash: 81f35ccb1619ef2e815f8add3878e72e1f22e65b62a8cf288e8ccd6dbd741210
                                                  • Instruction Fuzzy Hash: 9951B2713407026BD215EB60CD9AF6F73AAEBC4B04F04491CF6459B2D0EEB4E901879A
                                                  APIs
                                                  • SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 0042EF55
                                                  • SendMessageW.USER32(?,00001004,-00000001,-00000001), ref: 0042EF6C
                                                  • SendMessageW.USER32(?,00001004,-00000001,-00000001), ref: 0042EF88
                                                  • SendMessageW.USER32(?,0000100C,-00000002,00000002), ref: 0042EFF2
                                                  • SendMessageW.USER32(?,00001008,?,00000000), ref: 0042F0A9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: `=
                                                  • API String ID: 3850602802-2762138152
                                                  • Opcode ID: 1b28692c5bafc0e0b03818e8d9035994aace83cec63172a9aced00264d4cecb8
                                                  • Instruction ID: 4a8da6b0a3b4820785d32a6e99519bf5ba1baf34d33d3eec9a517c422a0835b5
                                                  • Opcode Fuzzy Hash: 1b28692c5bafc0e0b03818e8d9035994aace83cec63172a9aced00264d4cecb8
                                                  • Instruction Fuzzy Hash: 9C51E2716083109BD720DF25E981B5BB7F4FB88710F800A7EF94997392D775E8058B9A
                                                  APIs
                                                  • SHBrowseForFolderW.SHELL32 ref: 0042EDC0
                                                  • SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0042EDEF
                                                  • GetLongPathNameW.KERNEL32(0047D9D0,00000000), ref: 0042EE38
                                                  • GetLongPathNameW.KERNEL32(0047D9D0,00000000), ref: 0042EE65
                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0042EEC4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Path$LongName$BrowseFolderFromListMessageSend
                                                  • String ID: 3402075
                                                  • API String ID: 3410855119-2194680865
                                                  • Opcode ID: e6d7c4e539e09ccdccd185b6b38999d2c4effd13c27e3da9bd57aaf8eb70b9d9
                                                  • Instruction ID: 60252550f2a576e17c879c635a3a802f8da064449550e8d1e332f21db53478d5
                                                  • Opcode Fuzzy Hash: e6d7c4e539e09ccdccd185b6b38999d2c4effd13c27e3da9bd57aaf8eb70b9d9
                                                  • Instruction Fuzzy Hash: 3F416471508301AFD310DF65DDC8EABBBE8FB58351F40092EF55A921E0D7749849CB5A
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ActiveMessageWindow
                                                  • String ID: 3400001$3400101$3401090$rY
                                                  • API String ID: 3610105657-3605576623
                                                  • Opcode ID: 5932f68488161c627aebd4246385e4a992ea64bdc1114815fce31a9279d2be1f
                                                  • Instruction ID: 6a8541e3f689305ec2f6cb5d2be3b4f28d8c1de2ea2bbd417e2b40b4f34285ca
                                                  • Opcode Fuzzy Hash: 5932f68488161c627aebd4246385e4a992ea64bdc1114815fce31a9279d2be1f
                                                  • Instruction Fuzzy Hash: B44193B1704210ABD710EB65EC45BAB73A8AF94704F40892FF90ED2290DB78ED45C76D
                                                  APIs
                                                  • _ValidateLocalCookies.LIBCMT ref: 00503601
                                                  • ___except_validate_context_record.LIBVCRUNTIME ref: 00503609
                                                  • _ValidateLocalCookies.LIBCMT ref: 00503692
                                                  • __IsNonwritableInCurrentImage.LIBCMT ref: 005036BD
                                                  • _ValidateLocalCookies.LIBCMT ref: 00503712
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
                                                  • String ID: csm
                                                  • API String ID: 1170836740-1018135373
                                                  • Opcode ID: 80e18b6aafd1d9acec2835737ad136747c20234a7744efa4a1d943050bc4d395
                                                  • Instruction ID: 8c319b8de6cf368726d111083056fe9cedfc1dc51f9fc976aac1017ab9f9d3cb
                                                  • Opcode Fuzzy Hash: 80e18b6aafd1d9acec2835737ad136747c20234a7744efa4a1d943050bc4d395
                                                  • Instruction Fuzzy Hash: E1417234A00205AFCF10DF69C845A9EBFA9FF85314F1481A6E8196B3D2D7329B15CB91
                                                  APIs
                                                  • GetClientRect.USER32(?,?), ref: 004674EB
                                                  • GetParent.USER32(?), ref: 004674FB
                                                  • GetWindowRect.USER32(?,?), ref: 0046751B
                                                  • GetParent.USER32(?), ref: 0046752A
                                                  • CreateCompatibleDC.GDI32(?), ref: 00467561
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0046758A
                                                  • BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 004675DC
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CompatibleCreateParentRect$BitmapClientWindow
                                                  • String ID:
                                                  • API String ID: 1335343179-0
                                                  • Opcode ID: ae058cf5547a5b73137727556229a9f4d12eeb23d99a6f799289078dd219408d
                                                  • Instruction ID: ec974f87df7e9fb3a3618fae45b6badb24d167debaf80877d84b9ed91747ca3a
                                                  • Opcode Fuzzy Hash: ae058cf5547a5b73137727556229a9f4d12eeb23d99a6f799289078dd219408d
                                                  • Instruction Fuzzy Hash: 7D411AB1508740AFC315DF68C985E5BBBE8FBD8714F008A1EF59A93290DB74E844CB66
                                                  APIs
                                                  • GetSubMenu.USER32(00000010,00000002), ref: 0042352E
                                                  • GetCursorPos.USER32(B7F9C0F2), ref: 00423545
                                                  • SetForegroundWindow.USER32(?), ref: 0042354F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CursorForegroundMenuWindow
                                                  • String ID: 3401016
                                                  • API String ID: 390680170-1597404659
                                                  • Opcode ID: 06d2a588dec87a76a36fb63f18f7d06653279be6ec553af71c6d46904ea7b1f7
                                                  • Instruction ID: a08165e610b34e817a5423f464ddcc9bce1135992548fc6a69cc7effbf604316
                                                  • Opcode Fuzzy Hash: 06d2a588dec87a76a36fb63f18f7d06653279be6ec553af71c6d46904ea7b1f7
                                                  • Instruction Fuzzy Hash: 9D31C472304340BBD324DF64D845F6B77A8EB84714F108A2FF50997680DB7DE8448BA9
                                                  APIs
                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,00000000,?,?,004543B4,?,00000000,00000000), ref: 004541C4
                                                  • DeviceIoControl.KERNEL32 ref: 00454215
                                                  • GetLastError.KERNEL32 ref: 0045421F
                                                  • GetLastError.KERNEL32 ref: 0045422C
                                                  • CloseHandle.KERNEL32(00000000,?,B7F9C0F2,?,00000000,?,?,004543B4,?,00000000,00000000,?,?,?,?,?), ref: 00454273
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseControlCreateDeviceFileHandle
                                                  • String ID: \\.\C:
                                                  • API String ID: 1177325624-259948872
                                                  • Opcode ID: 97f6d277518962508a84672de340e9009c68024a49f3c9384519941a69a054d2
                                                  • Instruction ID: 8413255d3e20ee0171831c1fd4e9de5db1cf6cd8e0bd52f5cbead1f2af0ef7cc
                                                  • Opcode Fuzzy Hash: 97f6d277518962508a84672de340e9009c68024a49f3c9384519941a69a054d2
                                                  • Instruction Fuzzy Hash: 943169B1A08310AFD310DF55D884A5BBBE8EBC9758F00492EF948D7351D6749884CB9A
                                                  APIs
                                                  • _TrackMouseEvent.COMCTL32(00000010), ref: 0042E774
                                                  • PtInRect.USER32(?,?,?), ref: 0042E7A7
                                                  • GetClientRect.USER32(?,?), ref: 0042E7C2
                                                  • PtInRect.USER32(?,?,?), ref: 0042E7FC
                                                  • RedrawWindow.USER32(?,?,00000000,00000105), ref: 0042E821
                                                  • RedrawWindow.USER32(?,?,00000000,00000105), ref: 0042E83C
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 0042E84F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: RectRedrawWindow$ClientEventMouseTrack
                                                  • String ID:
                                                  • API String ID: 4196163336-0
                                                  • Opcode ID: 54eeda5e9cc18010a30806788d475c85a44e97beb02a1b7b18afe2bd2e815317
                                                  • Instruction ID: c4f66d3cff0941ef47ae988eb42254fc96aed82a1b76600b02dc3c2c7e15cd00
                                                  • Opcode Fuzzy Hash: 54eeda5e9cc18010a30806788d475c85a44e97beb02a1b7b18afe2bd2e815317
                                                  • Instruction Fuzzy Hash: F03127B15047059FD314DF69D880AABBBE9FB88314F044A2EF59A83350E770E944CFA6
                                                  APIs
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105,B7F9C0F2,75A85540,?,?,00421AA0,B7F9C0F2), ref: 004242B3
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 004242C5
                                                    • Part of subcall function 00425460: RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,00000000,?,Button_Check,?,?,00420A23), ref: 004254D9
                                                  • SendMessageW.USER32(?,00000402,?,00000000), ref: 00424398
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: RedrawWindow$MessageSend
                                                  • String ID: %s: %I64u $3401050$3401080
                                                  • API String ID: 730354411-73662114
                                                  • Opcode ID: 34c2affe364ff515f50bf47c1b61d1c427e18055d02fed05966bd6094f2674e3
                                                  • Instruction ID: 8816fc286b8afc534f6afc75fd391673b4d725b22e86aab22ab11b698ddc2395
                                                  • Opcode Fuzzy Hash: 34c2affe364ff515f50bf47c1b61d1c427e18055d02fed05966bd6094f2674e3
                                                  • Instruction Fuzzy Hash: BE3182B1654700ABC310EF25DC42F9B77E8FF84B15F104A1EF59AA21D0DBB8A544CB99
                                                  APIs
                                                  • SetForegroundWindow.USER32(?), ref: 00423369
                                                  • Shell_NotifyIconW.SHELL32(00000001), ref: 00423448
                                                  • GetLastError.KERNEL32 ref: 00423452
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ErrorForegroundIconLastNotifyShell_Window
                                                  • String ID: $>$3401082$3401083
                                                  • API String ID: 4150770455-2005305407
                                                  • Opcode ID: 7028775615fcb4f910a592c69760713685972df336b13bea8f76cfa9de920131
                                                  • Instruction ID: 90de86b5fd52155df775e515d11431d32a4523fc17091ff82a2e95fa86d8e88e
                                                  • Opcode Fuzzy Hash: 7028775615fcb4f910a592c69760713685972df336b13bea8f76cfa9de920131
                                                  • Instruction Fuzzy Hash: E2317EB1644301ABD310DF64DC4AFABB7E4FF44710F10892EF65EA2290DBB9A544CB99
                                                  APIs
                                                  • SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 00432EB2
                                                  • SendMessageW.USER32(?,0000100C,-00000002,00000002), ref: 00432EF5
                                                  • SendMessageW.USER32(?,00001008,-00000002,00000000), ref: 00432F33
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402077$3402078$3402079
                                                  • API String ID: 3850602802-670106401
                                                  • Opcode ID: 1e581721c84f0c249b880909b493c1dbc8988a95a366e13f64cc3adfbf7eb187
                                                  • Instruction ID: c04858277577f06559cf2ee2803e4bbf63125390443237cb6e41332b9df5dc51
                                                  • Opcode Fuzzy Hash: 1e581721c84f0c249b880909b493c1dbc8988a95a366e13f64cc3adfbf7eb187
                                                  • Instruction Fuzzy Hash: 3A2183B56947406BD321DF50CD86FAB73A8EB88B11F10491FF31EA25C0CAA8A804976D
                                                  APIs
                                                  • GetClientRect.USER32(?,?), ref: 00431D46
                                                  • CreateCompatibleDC.GDI32(?), ref: 00431D78
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 00431D9E
                                                  • SelectObject.GDI32(?,?), ref: 00431DBC
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00431DCA
                                                  • BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00431E69
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CompatibleCreate$BitmapClientMessageObjectRectSelectSend
                                                  • String ID:
                                                  • API String ID: 2414545248-0
                                                  • Opcode ID: 8c412c0476ba2fc4ae0c4b603c0ca6f6675f8a42d5d8e24ea628546f2118f678
                                                  • Instruction ID: 8bb2e0385ae3c531c2e170360c03eff7dceb5b5f9b27b4236f5b68df8b256744
                                                  • Opcode Fuzzy Hash: 8c412c0476ba2fc4ae0c4b603c0ca6f6675f8a42d5d8e24ea628546f2118f678
                                                  • Instruction Fuzzy Hash: 22412AB1508340AFC314DF68C985E5BBBE8FBC8714F048A1EF59993291DBB4E904CB66
                                                  APIs
                                                  • CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,B7F9C0F2), ref: 0045FBFD
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045FD6C
                                                  • GetLastError.KERNEL32 ref: 00460023
                                                  • CloseHandle.KERNEL32(?), ref: 00460032
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateErrorFileHandleLastUnothrow_t@std@@@__ehfuncinfo$??2@
                                                  • String ID: \\.\C:
                                                  • API String ID: 2002255750-259948872
                                                  • Opcode ID: b87631538b8cc68bed2421bc01e14d4570ddd1f2682536a7380720e1d761cbe2
                                                  • Instruction ID: f68b579a164141f6a35d8a11ab023a6fd55b536e149a63f8f0d67cb16e8cd9f8
                                                  • Opcode Fuzzy Hash: b87631538b8cc68bed2421bc01e14d4570ddd1f2682536a7380720e1d761cbe2
                                                  • Instruction Fuzzy Hash: 53F139B15183419FC324DF25C881AAFB7E4BF89714F104A2EF99983351E778A948CB97
                                                  APIs
                                                  • GetTextExtentPoint32W.GDI32(?,00000000,?,?), ref: 004055AD
                                                  • GetTextExtentPoint32W.GDI32(?,...,00000003,?), ref: 0040561D
                                                  • GetTextExtentPoint32W.GDI32(?,00000000,?,?), ref: 00405675
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExtentPoint32Text
                                                  • String ID: ...$`=
                                                  • API String ID: 223599850-889875407
                                                  • Opcode ID: 156e8fc8da26a19be13ee25471945571a97a93295a4a61b50d832e449c7150af
                                                  • Instruction ID: 472bae36e9bbe25dca023677f1d007ac7a5f0ef4219e7f68ecfc9801725c9705
                                                  • Opcode Fuzzy Hash: 156e8fc8da26a19be13ee25471945571a97a93295a4a61b50d832e449c7150af
                                                  • Instruction Fuzzy Hash: 31E131755087059FC310DF68C884A5BBBE5FB88304F548A2EF896A33A1D774E885CF96
                                                  APIs
                                                  • SelectObject.GDI32(00000000,00000000), ref: 004042FE
                                                  • GetDIBColorTable.GDI32(00000000,?,00000001,?,?,?,004042D6,?,?,?,?,?,?,?,00000000), ref: 0040431B
                                                  • TransparentBlt.MSIMG32(?,?,?,?,?,00000000,?,?,?,00000000,00000000,?,004042D6,?,?,?), ref: 00404360
                                                  • SelectObject.GDI32(00000000,?), ref: 004043F4
                                                    • Part of subcall function 00401270: InterlockedExchange.KERNEL32(00497DDC,00000000), ref: 00401283
                                                    • Part of subcall function 00401270: CreateCompatibleDC.GDI32(00000000), ref: 00401295
                                                  • AlphaBlend.MSIMG32(?,?,?,?,?,00000000,?,?,?,00000000,00000000,?,?,004042D6,?), ref: 004043AC
                                                  • StretchBlt.GDI32(?,?,?,?,?,00000000,?,?,?,00000000,00CC0020), ref: 004043DE
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ObjectSelect$AlphaBlendColorCompatibleCreateExchangeInterlockedStretchTableTransparent
                                                  • String ID:
                                                  • API String ID: 1847558199-0
                                                  • Opcode ID: 2ccb637a71d9e589383f213da76c4c0399f3231d086deb3d0b5e9ca5541171ac
                                                  • Instruction ID: 431ece418818d9ed3e284c2d9fdf2eea9b1bc5e51d71579e1970bbd9de33fc15
                                                  • Opcode Fuzzy Hash: 2ccb637a71d9e589383f213da76c4c0399f3231d086deb3d0b5e9ca5541171ac
                                                  • Instruction Fuzzy Hash: 6641C9B1208740AFD214CB6AC884E2BB7E9EBCD718F108B1DF59DA3691D674ED01CB65
                                                  APIs
                                                  • SendMessageW.USER32(?,00000401,00008004,00000000), ref: 00424B28
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID:
                                                  • API String ID: 3850602802-0
                                                  • Opcode ID: 0e9a12f4cd1428a8c886e080b16f46ae2ab08dd8028c450c4ed05d7ef20e7a6a
                                                  • Instruction ID: 473d6bda932dfe5e5726b0cd1595cc7b0c8836d5ab7cb817983b5e362455a3d3
                                                  • Opcode Fuzzy Hash: 0e9a12f4cd1428a8c886e080b16f46ae2ab08dd8028c450c4ed05d7ef20e7a6a
                                                  • Instruction Fuzzy Hash: 6A21D87176021077EB60AA94DCC6FD12354AB54B05F44407ABB04BE1C6CFEA6440CB69
                                                  APIs
                                                  • IsWindowVisible.USER32(?), ref: 0041109B
                                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 004110AE
                                                  • IsWindowVisible.USER32(?), ref: 004110CF
                                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 004110E2
                                                  • IsWindowVisible.USER32(?), ref: 0041110B
                                                  • SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 0041111E
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSendVisibleWindow
                                                  • String ID:
                                                  • API String ID: 3984873885-0
                                                  • Opcode ID: 39c62f6c9bf8f9dbe62311a360a421a223595c9398a47a098b9634c644438ce1
                                                  • Instruction ID: f50cee19580f5a7b4a735ae81b0960ad1265907f2bd47cc1e7f642e33356c098
                                                  • Opcode Fuzzy Hash: 39c62f6c9bf8f9dbe62311a360a421a223595c9398a47a098b9634c644438ce1
                                                  • Instruction Fuzzy Hash: AC21A070A40316ABD730DF759C41BAB7698BB88740F050A3EB649DB391EA75EC80879D
                                                  APIs
                                                  • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000004FF), ref: 00429964
                                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0042998F
                                                  • TranslateMessage.USER32(?), ref: 0042999A
                                                  • DispatchMessageW.USER32(?), ref: 004299A1
                                                  • PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004299B0
                                                  • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000004FF), ref: 004299C9
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Message$MultipleObjectsPeekWait$DispatchTranslate
                                                  • String ID:
                                                  • API String ID: 1800058468-0
                                                  • Opcode ID: 422089f6943f840a1857ebeeed2a55ac56a072af819dc62ccc93b1be93c737d0
                                                  • Instruction ID: 4b68c3bfc8aa6a65b644341b41cfaa7d1e4508deb0fbdda8f8db971c9f13aea2
                                                  • Opcode Fuzzy Hash: 422089f6943f840a1857ebeeed2a55ac56a072af819dc62ccc93b1be93c737d0
                                                  • Instruction Fuzzy Hash: D5316BB1604311AFE310CF68DC80F6BB7E5BB88710F504A1DF648DB290E774E9848BA6
                                                  APIs
                                                  • CreateCompatibleDC.GDI32(?), ref: 0040E9D6
                                                  • LPtoDP.GDI32(?,?,00000002), ref: 0040E9EE
                                                  • CreateCompatibleBitmap.GDI32(?,?,?), ref: 0040EA08
                                                  • GetMapMode.GDI32(?,?,0047D9F0,00000000), ref: 0040EA2E
                                                  • DPtoLP.GDI32(?,?,00000002), ref: 0040EA45
                                                  • GetBkColor.GDI32(?), ref: 0040EA78
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CompatibleCreate$BitmapColorMode
                                                  • String ID:
                                                  • API String ID: 451781270-0
                                                  • Opcode ID: 823297d3b1078f9247b71e0cb78166e85bcb58cd2136858b8ed66297f6f43318
                                                  • Instruction ID: 3bfa88b0da709e4d3224c5894ad5c167e82e64c80dae2195e34fb9d2b55d46f1
                                                  • Opcode Fuzzy Hash: 823297d3b1078f9247b71e0cb78166e85bcb58cd2136858b8ed66297f6f43318
                                                  • Instruction Fuzzy Hash: 3931E975200600AFC724DF65D984D5BB7E9FF88700B448A2DA94A8B646DB34E944CFA5
                                                  APIs
                                                  • GetDC.USER32(00000000), ref: 004650D8
                                                  • GetDeviceCaps.GDI32(00000000,00000008), ref: 004650E9
                                                  • GetDeviceCaps.GDI32(00000000,0000000A), ref: 004650F0
                                                  • GetDeviceCaps.GDI32(00000000,00000058), ref: 004650F9
                                                  • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00465108
                                                  • ReleaseDC.USER32(00000000,00000000), ref: 0046512C
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CapsDevice$Release
                                                  • String ID:
                                                  • API String ID: 1035833867-0
                                                  • Opcode ID: 1baab8f901f74b7d771640b7584b37378778b1bccb696bde4da89b114f453174
                                                  • Instruction ID: c3f58fe0059228c05da5b00147ff564d140f859395390daa2f6f08e4d30ee4c4
                                                  • Opcode Fuzzy Hash: 1baab8f901f74b7d771640b7584b37378778b1bccb696bde4da89b114f453174
                                                  • Instruction Fuzzy Hash: 5E21FF74900F00AAE3302F21EC89717BBF4FB85741F918D2EE5C5406A0EB3594688B4A
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • GetSystemTimeAsFileTime.KERNEL32(?), ref: 0045619C
                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 004561B2
                                                  • GetTickCount.KERNEL32 ref: 004561D8
                                                  • FileTimeToSystemTime.KERNEL32(?,?), ref: 00456226
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Time$FileSystem$CountCriticalEnterSectionTick
                                                  • String ID: `=
                                                  • API String ID: 220952284-2762138152
                                                  • Opcode ID: ed327b58cb72b8de964197ca6503e642e78c977d148f21e18fd67b06730e159f
                                                  • Instruction ID: 934190aa3f0b3ae95b724ee9cdb0041c178ee72d2cde610639a7ed787e377e39
                                                  • Opcode Fuzzy Hash: ed327b58cb72b8de964197ca6503e642e78c977d148f21e18fd67b06730e159f
                                                  • Instruction Fuzzy Hash: FDD117B1A04B06EFC314DF65C484A9AFBE4FF48701F904A1EE85993611DB34B958CF9A
                                                  APIs
                                                  • SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 0042571B
                                                  • SendMessageW.USER32(?,0000100C,-00000002,00000002), ref: 00425737
                                                  • InvalidateRect.USER32(?,00000000,00000001,?,?,?,?,?,?,?,?,?,?), ref: 00425888
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$InvalidateRect
                                                  • String ID: Button_Check$`=
                                                  • API String ID: 2778011698-3236272720
                                                  • Opcode ID: 45b91e48737b704d3f690cfb1dc7e8588fa66482c43df7c3c5e128cf77c7356e
                                                  • Instruction ID: 0eaeb928ae6b5a569979d6d52056a3389dc0ef6ae13505e9256ef6b005c906b2
                                                  • Opcode Fuzzy Hash: 45b91e48737b704d3f690cfb1dc7e8588fa66482c43df7c3c5e128cf77c7356e
                                                  • Instruction Fuzzy Hash: 55510432304611DFC724EF68D8C4E9BB7A4EF88320F514A2AE95597391D774FC418BAA
                                                  APIs
                                                  • SendMessageW.USER32(?,0000100C,000000FF,00000002), ref: 00432C6E
                                                  • SendMessageW.USER32(?,0000100C,-00000002,00000002), ref: 00432CB4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402077$3402078$tFH
                                                  • API String ID: 3850602802-2744557037
                                                  • Opcode ID: e2eade7c088f4acd36f84f916c9b0db3ac6b8ce42b926bd53535cf3080841c0b
                                                  • Instruction ID: 0052325b0c9a5ab111783a0a252863c2f47d3c18ee4d5c8230f443e5887af2fe
                                                  • Opcode Fuzzy Hash: e2eade7c088f4acd36f84f916c9b0db3ac6b8ce42b926bd53535cf3080841c0b
                                                  • Instruction Fuzzy Hash: 415160712083819FD325EF20DE99FDBB7E4AF99704F00491EF18E92191CBB46948CB5A
                                                  APIs
                                                  • OpenThemeData.UXTHEME(?,LISTVIEW,00000001), ref: 00416A0B
                                                  • DrawThemeBackground.UXTHEME(?,?,00000006,00000002,?,00000000,?,00FFFFFF), ref: 00416A5D
                                                  • CloseThemeData.UXTHEME(?), ref: 00416A68
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00416A89
                                                    • Part of subcall function 00416430: GetWindowRect.USER32(?,?), ref: 00416443
                                                    • Part of subcall function 00416430: InflateRect.USER32(?,00000002,00000002), ref: 00416452
                                                    • Part of subcall function 00416430: GetParent.USER32(?), ref: 00416467
                                                    • Part of subcall function 00416430: GetParent.USER32(?), ref: 0041647A
                                                    • Part of subcall function 00416430: InvalidateRect.USER32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000,00478B80,000000FF,00416365), ref: 0041648D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: RectTheme$DataParent$BackgroundCloseDrawInflateInvalidateMessageOpenSendWindow
                                                  • String ID: LISTVIEW
                                                  • API String ID: 2600991427-1680257557
                                                  • Opcode ID: 0229e11747b3cd2e378b549adb87a154061692a6bd490272b80820133ddceee6
                                                  • Instruction ID: fa80797a93d1b306fb8333d11dc9e085901b6c38828278b42b81b7196f356a38
                                                  • Opcode Fuzzy Hash: 0229e11747b3cd2e378b549adb87a154061692a6bd490272b80820133ddceee6
                                                  • Instruction Fuzzy Hash: 415106B56083009FC314DF68C981A6BB7E9FF88744F108A2EF59987390D778E945CB96
                                                  APIs
                                                  • InvalidateRect.USER32(?,00000000,00000001), ref: 00424680
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 0042471F
                                                  • SetTimer.USER32(?,00000002,000003E8,00000000), ref: 0042474F
                                                  • KillTimer.USER32(?,00000002), ref: 00424770
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Timer$InvalidateKillRectRedrawWindow
                                                  • String ID: `=
                                                  • API String ID: 4168450595-2762138152
                                                  • Opcode ID: 8d72688a5271403dce2d565fb5cb8f01ebbe79f233b85fa5517f2f7365920491
                                                  • Instruction ID: 7d708aa27c06dc00fcb9f864fdcaa6ded2618e4328842cf70fbd9c9851442ce7
                                                  • Opcode Fuzzy Hash: 8d72688a5271403dce2d565fb5cb8f01ebbe79f233b85fa5517f2f7365920491
                                                  • Instruction Fuzzy Hash: 3941A23170021ADFC730EF65EC88B9AB3A5FF85315F50452EE85997290CB78A984CF69
                                                  APIs
                                                  • SHBrowseForFolderW.SHELL32 ref: 0041DC8E
                                                  • SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 0041DCBD
                                                  • GetLongPathNameW.KERNEL32(0047D9D0,00000000), ref: 0041DD06
                                                  • GetLongPathNameW.KERNEL32(B7F9C0F2,00000000), ref: 0041DD33
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Path$LongName$BrowseFolderFromList
                                                  • String ID: 3402075
                                                  • API String ID: 4132326259-2194680865
                                                  • Opcode ID: bd1580488c3d15575b1391a656ffdd20babe2d7e46e482bada2f60351b01d740
                                                  • Instruction ID: a9706069ea416aad4f302c8e8149c97dc391afa5e31a47db3cf999b1b5352ce6
                                                  • Opcode Fuzzy Hash: bd1580488c3d15575b1391a656ffdd20babe2d7e46e482bada2f60351b01d740
                                                  • Instruction Fuzzy Hash: AD4152715083419FC314EF64DD88AABBBF4FB89710F400A3EF65A922A0DB759944CB5A
                                                  APIs
                                                  • SHGetSpecialFolderPathW.SHELL32(00000000,00000000,?,?,00093E00,00000000,00476569,000000FF,0041A806), ref: 0041A883
                                                  • PathFileExistsW.SHLWAPI(?,?,?,?,00093E00,00000000,00476569,000000FF,0041A806), ref: 0041A8F4
                                                  • SHCreateDirectory.SHELL32(00000000,?,?,?,?,00093E00,00000000,00476569,000000FF,0041A806), ref: 0041A904
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Path$CreateDirectoryExistsFileFolderSpecial
                                                  • String ID: DiskDefrag$\DiskDefrag
                                                  • API String ID: 106629909-1352560241
                                                  • Opcode ID: a2d3dbced54b8fdd5c0ae5b42ab46fad3f2ef9f23a5d0fc133a43e43219cb9af
                                                  • Instruction ID: 938fb3785b8e758ab9aa55aacaf13088161b2d62692eeac53cc892e3a5652775
                                                  • Opcode Fuzzy Hash: a2d3dbced54b8fdd5c0ae5b42ab46fad3f2ef9f23a5d0fc133a43e43219cb9af
                                                  • Instruction Fuzzy Hash: CE4195B16083019BD300EF65DD85AABB7E4FF98714F00453EF54AD2290EB349949CBAB
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ObjectSelect
                                                  • String ID: `=
                                                  • API String ID: 1517587568-2762138152
                                                  • Opcode ID: 116e8130f725741a0df8cffd76ef37318a9139d2394634156b2cf1340f76da15
                                                  • Instruction ID: 398bc34aaeb48a28786a3eeef8d096b9ba9882d646282afc346b5bddce66a1f9
                                                  • Opcode Fuzzy Hash: 116e8130f725741a0df8cffd76ef37318a9139d2394634156b2cf1340f76da15
                                                  • Instruction Fuzzy Hash: 36417E32200A048FD724EFA9E884E6BF3A5EF94321B05852FE84A97611DB35F840CB55
                                                  APIs
                                                    • Part of subcall function 00467820: DeleteObject.GDI32(00000000), ref: 00467935
                                                  • GdiplusShutdown.GDIPLUS(?,?,B7F9C0F2,00093C38,?,?,00093E00,?,00000000,0047812F,000000FF,0041A4F1,B7F9C0F2,00093C38,?,00093E00), ref: 00465814
                                                  • DeleteObject.GDI32(?), ref: 004658CF
                                                  • DeleteObject.GDI32(?), ref: 00465921
                                                  • DeleteObject.GDI32(?), ref: 00465973
                                                  • DeleteObject.GDI32(?), ref: 004659C5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DeleteObject$GdiplusShutdown
                                                  • String ID:
                                                  • API String ID: 1337965791-0
                                                  • Opcode ID: 3a50086e46136d6d50168286cddb443a9cc0a0107472165b4ab84f4d896fe486
                                                  • Instruction ID: 5b8780734ed73be5f4f2893b0bea8a6c3b62fc8eaf033f1e837d6edea0f0e4aa
                                                  • Opcode Fuzzy Hash: 3a50086e46136d6d50168286cddb443a9cc0a0107472165b4ab84f4d896fe486
                                                  • Instruction Fuzzy Hash: 8361E6B0505F409FC360DF3A9880B9BFBE4BB48305F90492EE1AE93241DB796548CF5A
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: __aullrem$__aulldiv
                                                  • String ID:
                                                  • API String ID: 3670715282-0
                                                  • Opcode ID: 9c34d576a32de794e1e0b0d0fca0d0e7c205ee0b047ab4e09ce85ba4a67a3df8
                                                  • Instruction ID: fa94849079e70c1b34915df37323d6afc94868806176a113829b563514bd0fbf
                                                  • Opcode Fuzzy Hash: 9c34d576a32de794e1e0b0d0fca0d0e7c205ee0b047ab4e09ce85ba4a67a3df8
                                                  • Instruction Fuzzy Hash: 43311775208305AFD200EA65E881D2FB3E9EBC8749F50491EF98497302D738FD498AB6
                                                  APIs
                                                  • lstrlenW.KERNEL32(0041F6D0,?,75A85540,?,?,0041F6D0,00000000,?,00000000,03E80000,?,00000000,?,DiskDefrag,DiskCheckMask,00000000), ref: 004262B5
                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,75A85540,00000001,00000000,?,00000000,00000000,?,75A85540,?,?,0041F6D0,00000000,?,00000000), ref: 004262E1
                                                  • GetLastError.KERNEL32(?,75A85540,?,?,0041F6D0,00000000,?,00000000,03E80000,?,00000000,?,DiskDefrag,DiskCheckMask,00000000,?), ref: 004262F2
                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,75A85540,00000001,00000000,00000000,00000000,00000000,?,75A85540,?,?,0041F6D0,00000000,?,00000000), ref: 0042630F
                                                  • WideCharToMultiByte.KERNEL32(00000000,00000000,75A85540,00000001,00000000,00000000,00000000,00000000,?,75A85540,?,?,0041F6D0,00000000,?,00000000), ref: 00426330
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ByteCharMultiWide$ErrorLastlstrlen
                                                  • String ID:
                                                  • API String ID: 3322701435-0
                                                  • Opcode ID: 406f029fa45b1055b96b03b8e5df20f9be275f8369c24922fb13ea929e72a033
                                                  • Instruction ID: cb33d9e4ec5480741093735bde79ecc2fcd6722e1911622dc14afd3accb78fd4
                                                  • Opcode Fuzzy Hash: 406f029fa45b1055b96b03b8e5df20f9be275f8369c24922fb13ea929e72a033
                                                  • Instruction Fuzzy Hash: 3E1191713803156BE220AFA4ECC6F27769CD745B04F61083DFB45AA2C1D5A47C448668
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Rect$Client$EventMouseTrack
                                                  • String ID:
                                                  • API String ID: 1879027383-0
                                                  • Opcode ID: f4e17d1d92922ba5e38ce16bca10ed58a203127cbb1472af428a1092aff2016b
                                                  • Instruction ID: 080451bb04fed4ed38a755b401fe0e9ad2b372c89e4fc55ac88ae6bf0dae2c00
                                                  • Opcode Fuzzy Hash: f4e17d1d92922ba5e38ce16bca10ed58a203127cbb1472af428a1092aff2016b
                                                  • Instruction Fuzzy Hash: 84115EB5104745AFD724CF64C848B9B77E8FB84304F10893EE88A87690E7B9E588CB95
                                                  APIs
                                                  • GetDC.USER32(00000000), ref: 0046CF84
                                                  • SelectObject.GDI32(?,?), ref: 0046CFAB
                                                  • PatBlt.GDI32(?,?,?,?,?,005A0049), ref: 0046CFCB
                                                  • SelectObject.GDI32(?,00000000), ref: 0046CFDA
                                                  • ReleaseDC.USER32(00000000,?), ref: 0046CFF1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ObjectSelect$Release
                                                  • String ID:
                                                  • API String ID: 3581861777-0
                                                  • Opcode ID: 09afa59c7c7bf345e2bd9cfd905d74781f37247dddbab7f6bac84dc0e12143ed
                                                  • Instruction ID: daceeca4effa55fca9f5214fa6f3dce8251d9e38b51f783a69048b93fac7a53b
                                                  • Opcode Fuzzy Hash: 09afa59c7c7bf345e2bd9cfd905d74781f37247dddbab7f6bac84dc0e12143ed
                                                  • Instruction Fuzzy Hash: 751115B5200601AFC314DFA9C9C8C27B7EAFF88600700C62DB94987601DB35FC45CB64
                                                  APIs
                                                  • GetWindowRect.USER32(?,?), ref: 00416443
                                                  • InflateRect.USER32(?,00000002,00000002), ref: 00416452
                                                  • GetParent.USER32(?), ref: 00416467
                                                  • GetParent.USER32(?), ref: 0041647A
                                                  • InvalidateRect.USER32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,00000000,00478B80,000000FF,00416365), ref: 0041648D
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Rect$Parent$InflateInvalidateWindow
                                                  • String ID:
                                                  • API String ID: 3567486610-0
                                                  • Opcode ID: 2204eff79a0e70798fbd603735b2eda6009dd2241c77b76db33bd6b2d1834c9f
                                                  • Instruction ID: 59621ce25ffcf61443309c609473fb22192222cc28d28fc8a60ac4e9d60af83f
                                                  • Opcode Fuzzy Hash: 2204eff79a0e70798fbd603735b2eda6009dd2241c77b76db33bd6b2d1834c9f
                                                  • Instruction Fuzzy Hash: 9BF044B6100304BFC210EB74DC8AD6B77ACFBC8700F008A1DB58A87191EA74F540CB65
                                                  APIs
                                                  • EnterCriticalSection.KERNEL32(00497DC0,75FD5780,?,004658D6), ref: 0040122D
                                                  • EnterCriticalSection.KERNEL32(00497DC0), ref: 00401243
                                                  • GdiplusShutdown.GDIPLUS(00000000), ref: 0040124F
                                                  • LeaveCriticalSection.KERNEL32(00497DC0), ref: 00401263
                                                  • LeaveCriticalSection.KERNEL32(00497DC0), ref: 0040126A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CriticalSection$EnterLeave$GdiplusShutdown
                                                  • String ID:
                                                  • API String ID: 3506214061-0
                                                  • Opcode ID: b92e5560af5050c5c6993437e068edb64c42205fc1de9f9bdd2150818b8b9fdd
                                                  • Instruction ID: 085117cba8507ed758f2e3bd9e34728127d7a1f2de7180c4966a7f221b9c7101
                                                  • Opcode Fuzzy Hash: b92e5560af5050c5c6993437e068edb64c42205fc1de9f9bdd2150818b8b9fdd
                                                  • Instruction Fuzzy Hash: 16E0863166C2145ACA007BB6BC49B663F64AFC0B1471941BFE008B31E0C57855448FFD
                                                  APIs
                                                  • CreateThread.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00428B67
                                                  • WaitForMultipleObjects.KERNEL32(?,?,00000001,000000FF), ref: 00428C3B
                                                  • CloseHandle.KERNEL32 ref: 00428C8D
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CloseCreateHandleMultipleObjectsThreadWait
                                                  • String ID: `=
                                                  • API String ID: 1263187225-2762138152
                                                  • Opcode ID: 2d7ebfa6a9a2b4656dd8fa51e96b61bd1dce91ce0a765f2429ab83b963c119d1
                                                  • Instruction ID: a913cb5e350b9d2bc9fc20d1f9b00526ce29f1f5c0cea8f0350da80d90f5eb0a
                                                  • Opcode Fuzzy Hash: 2d7ebfa6a9a2b4656dd8fa51e96b61bd1dce91ce0a765f2429ab83b963c119d1
                                                  • Instruction Fuzzy Hash: 58D17F71706225DFC724EFA4E88462EB7B0BF44300F94896EF85597351DB75E880CBAA
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00422F48
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CriticalEnterRedrawSectionWindow
                                                  • String ID: DiskChecked$DiskDefrag$`=
                                                  • API String ID: 142774367-3347577070
                                                  • Opcode ID: 59c7556ff35f631bf204cef4fa8707c16d05c0d1fb6d4562dda13db1bf437196
                                                  • Instruction ID: fed9d3ca3bfe53db5501e1f63bebbc1333baccd255b2eb749adb8bf470123f53
                                                  • Opcode Fuzzy Hash: 59c7556ff35f631bf204cef4fa8707c16d05c0d1fb6d4562dda13db1bf437196
                                                  • Instruction Fuzzy Hash: E151A43170061AABC31CEF6CD995AA9F3A1BB84300F85862EED158B781D7B4B951DBC4
                                                  APIs
                                                  • DeleteObject.GDI32(00000000), ref: 00467935
                                                  • SendMessageW.USER32(?,0000040D,00000000,00000000), ref: 004679CE
                                                  • SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004679E4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend$DeleteObject
                                                  • String ID: `=
                                                  • API String ID: 4188969710-2762138152
                                                  • Opcode ID: 6ae490451279346f20ff5a9bdc53e8c576f5efa59d3a88cf8cb8055c59d1975e
                                                  • Instruction ID: 57d6ba00d9628d7bc6127d5ab1f70525051783d1f21ea283ef51d44a992bc025
                                                  • Opcode Fuzzy Hash: 6ae490451279346f20ff5a9bdc53e8c576f5efa59d3a88cf8cb8055c59d1975e
                                                  • Instruction Fuzzy Hash: 92612C70A08316DFD714EF64C884A1AB7A5BF84318F1088AEE955A7351E734EC45CFAB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Back$GUBar::CDrawObjectFactory::CreateRectTextDraw$Text
                                                  • API String ID: 0-2901586747
                                                  • Opcode ID: b1efb13953a751cb5c03bbcbe7c56556e47a523d44cd9f1edb886f055ae568a6
                                                  • Instruction ID: 94c29d93b79a1152409cb834b352fc504edd985983e521adcc95b20eb26bf893
                                                  • Opcode Fuzzy Hash: b1efb13953a751cb5c03bbcbe7c56556e47a523d44cd9f1edb886f055ae568a6
                                                  • Instruction Fuzzy Hash: A6514F75604315EFC710DF25C880A6BB7E8EB88754F104A2EF84997380E779ED458B9A
                                                  APIs
                                                  • SendMessageW.USER32(?,0000014E,?,00000000), ref: 004311B1
                                                  • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004311C3
                                                  Strings
                                                  • ColorIndex, xrefs: 00431185
                                                  • DiskDefrag\Setting Option\Gereral\DefragColor, xrefs: 0043118A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: ColorIndex$DiskDefrag\Setting Option\Gereral\DefragColor
                                                  • API String ID: 3850602802-1631410767
                                                  • Opcode ID: 502c51c2ec178f428166c2452066da618523e55121de244a43143375eb21c717
                                                  • Instruction ID: 3c3eec78f5ba70d7f73749eb8d42c303dcc8a252b1b76d151490117dce650f0e
                                                  • Opcode Fuzzy Hash: 502c51c2ec178f428166c2452066da618523e55121de244a43143375eb21c717
                                                  • Instruction Fuzzy Hash: F34119717802055BEB10AF75CD82FBA3284DB59764F000A3EFA06EF2D2DA6CDC48466D
                                                  APIs
                                                  • GetSystemPowerStatus.KERNEL32 ref: 00423907
                                                  • GetLongPathNameW.KERNEL32(00000001,00000000), ref: 004239E8
                                                  • GetLongPathNameW.KERNEL32(B7F9C0F2,00000000), ref: 00423A15
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: LongNamePath$PowerStatusSystem
                                                  • String ID: 3400003
                                                  • API String ID: 2229323602-2398869336
                                                  • Opcode ID: 057325de7599dd7353c85ea60434a88cbbf49cf5f83a7ab393cd0de2b9172bd1
                                                  • Instruction ID: 559a5a5f11ad9cbb26b2ef481da3000354db79d5173c1cf665cce4c119cf32f6
                                                  • Opcode Fuzzy Hash: 057325de7599dd7353c85ea60434a88cbbf49cf5f83a7ab393cd0de2b9172bd1
                                                  • Instruction Fuzzy Hash: 3C51C6712083419FD310EF20DD85BABB7F8AF88715F50092EF199921D1DB78AA49CB5A
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00422C04
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CriticalEnterRedrawSectionWindow
                                                  • String ID: DiskChecked$DiskDefrag$`=
                                                  • API String ID: 142774367-3347577070
                                                  • Opcode ID: 7b3785d154c84e13650d4089b12ddb33fc3ddbb9f3bc8d58731a5152a72f2c07
                                                  • Instruction ID: 0b9e0d0bd62f39a9103a5831cbb30b95e2098115bf74eedd830be0e4041926e5
                                                  • Opcode Fuzzy Hash: 7b3785d154c84e13650d4089b12ddb33fc3ddbb9f3bc8d58731a5152a72f2c07
                                                  • Instruction Fuzzy Hash: 644196313007059FC728EE2DDD85BAAB7E1BF84304F94852EED468F385DAB4B845C654
                                                  APIs
                                                    • Part of subcall function 0041DB30: GetLogicalDrives.KERNEL32 ref: 0041DB47
                                                    • Part of subcall function 0041DB30: GetDriveTypeW.KERNEL32(?,?,?,75A7AF60), ref: 0041DB8A
                                                  • SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00000200), ref: 00402ADD
                                                  • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00402AF7
                                                    • Part of subcall function 0041AA20: SHGetFileInfoW.SHELL32(?,00000000,000002B4,000002B4,00004001), ref: 0041AA4D
                                                  • SendMessageW.USER32(?,00001214,00000004,00000000), ref: 00402B9F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: FileInfoMessageSend$DriveDrivesLogicalType
                                                  • String ID: C:\
                                                  • API String ID: 2359154852-3404278061
                                                  • Opcode ID: 3170ff8149e9c2b6ee3bcf2834819091aa34d1669217c11efa96fe0deec9a490
                                                  • Instruction ID: 82d795afe4258906e57f36ef34ec2eb48dfa52df3f098ca2abc9abbdf1da0df4
                                                  • Opcode Fuzzy Hash: 3170ff8149e9c2b6ee3bcf2834819091aa34d1669217c11efa96fe0deec9a490
                                                  • Instruction Fuzzy Hash: D541D6717443406BE324DF61DC86FAA73A4AB84B04F00492DF249AB2C1DBB4A545CB9A
                                                  APIs
                                                  • GetLastError.KERNEL32 ref: 004619BD
                                                  • MessageBoxW.USER32(00000000,?,Disk Defrag,00040010), ref: 004619FE
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ErrorLastMessage
                                                  • String ID: %c:\$Disk Defrag
                                                  • API String ID: 463093485-3222931339
                                                  • Opcode ID: 518deffa12bdbb6d37a9a145068253991ac5e7d9b5727993573dfc0c972e2c19
                                                  • Instruction ID: 731faf273718486ffcde032920aca0e1f319cedce5eb76f7311323341e126d0a
                                                  • Opcode Fuzzy Hash: 518deffa12bdbb6d37a9a145068253991ac5e7d9b5727993573dfc0c972e2c19
                                                  • Instruction Fuzzy Hash: E64195712087419FC324DF25D845B6BB7E4EF84715F044A2EF599C7290EB74A808CB9B
                                                  APIs
                                                  • GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,?,0000000C,?), ref: 00410C49
                                                  • ExpandEnvironmentStringsW.KERNEL32(%HOMEDRIVE%,?,0000000C), ref: 00410C8F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: EnvironmentExpandInformationStringsVolume
                                                  • String ID: %HOMEDRIVE%$NTFS
                                                  • API String ID: 1751349637-3402063299
                                                  • Opcode ID: 074aaa8893bb910327e97c9f9852001168cb7cda255d028d6430084e15aab4d5
                                                  • Instruction ID: 637acb8aad6857eaaece39300668810a01c8d3601b07b0b48692e68ec32a0e85
                                                  • Opcode Fuzzy Hash: 074aaa8893bb910327e97c9f9852001168cb7cda255d028d6430084e15aab4d5
                                                  • Instruction Fuzzy Hash: 224160706083019BD714DF75CA86BAB77E4AF88704F40493EB949C7291EBB8D984CB5A
                                                  APIs
                                                  • GetVolumeInformationW.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,0000000C,0000000C,?,?,?,?,?,?,?,004619AE), ref: 004629EC
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: InformationVolume
                                                  • String ID: FAT$FAT16$FAT32
                                                  • API String ID: 2039140958-3969911809
                                                  • Opcode ID: 254a78ae61a87bb598648bcb239176478e62f78007c312b98b488536b990b747
                                                  • Instruction ID: 45468f2d8361374e2203d088d382e4daaec04f6418c830f46f854969d88bf3c3
                                                  • Opcode Fuzzy Hash: 254a78ae61a87bb598648bcb239176478e62f78007c312b98b488536b990b747
                                                  • Instruction Fuzzy Hash: 16112175A18300AED754EF789D92B6B77E4AF88704F84492EF848C3251F678D604CB9B
                                                  APIs
                                                  • KillTimer.USER32(?,00000001,00000000,3401029,0047D9D0,0047D9D0,0047D9D0,?,0041A424,00000000,00000005,?,00000066,00000000), ref: 004226F8
                                                  • SetTimer.USER32(?,00000001,000003E8,00000000), ref: 0042271F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Timer$Kill
                                                  • String ID: 3401028$3401029
                                                  • API String ID: 3307318486-3858196228
                                                  • Opcode ID: 0b4dd37929f5e26d15ed35f99a3ff5d0f5e2dd061a2436d59f470f072d9acaa2
                                                  • Instruction ID: 02bff0ae68159748c7f69b0dc43338cfbe1eaa20307d0c92b455edf88c414399
                                                  • Opcode Fuzzy Hash: 0b4dd37929f5e26d15ed35f99a3ff5d0f5e2dd061a2436d59f470f072d9acaa2
                                                  • Instruction Fuzzy Hash: 481184B574470097C3209B64DC81FEAB3A56F88750F20871FF26FA72D1C7A4B8419788
                                                  APIs
                                                  • SetRectEmpty.USER32(0000000C), ref: 0040DE94
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: EmptyRect
                                                  • String ID: Button$CDoubleDraw$Default
                                                  • API String ID: 2270935405-580154339
                                                  • Opcode ID: bc3e2d6f8ce831d7bf007855c4c2d232e2bdea8988ba371b820240db3263b0bd
                                                  • Instruction ID: ef19d2a367d3f1db560aaf5cf05e81b0258e296f30c95c9ac20d7302b86fa88f
                                                  • Opcode Fuzzy Hash: bc3e2d6f8ce831d7bf007855c4c2d232e2bdea8988ba371b820240db3263b0bd
                                                  • Instruction Fuzzy Hash: C611ABB1A447119BD3109F56CC42B97B6E8EB48B24F108A2FF519E72C1D7BC680447DD
                                                  APIs
                                                  • BeginDeferWindowPos.USER32(?), ref: 0046C51A
                                                  • EndDeferWindowPos.USER32(?), ref: 0046C576
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 0046C58F
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Window$Defer$BeginRedraw
                                                  • String ID: Button_Check
                                                  • API String ID: 2284443614-1860365581
                                                  • Opcode ID: 14033b2483b76df541bdd5ba0729d94ec0d0f5cbc8963acbd48a3d1fb77fda02
                                                  • Instruction ID: 5655fd99f899ac16fa463449df691d44eb2f3411b94b0263f5d23efcf872a4b1
                                                  • Opcode Fuzzy Hash: 14033b2483b76df541bdd5ba0729d94ec0d0f5cbc8963acbd48a3d1fb77fda02
                                                  • Instruction Fuzzy Hash: 5F21EDB4600702AFC310CF29C984A16FBE4BB88310F148A5EE59997261E734F945CB96
                                                  APIs
                                                  • mciSendCommandW.WINMM ref: 0041E210
                                                  • mciGetErrorStringW.WINMM(00000000,?,00000080), ref: 0041E23D
                                                  • mciSendCommandW.WINMM(00000001,00000806,00010000,?), ref: 0041E26C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CommandSend$ErrorString
                                                  • String ID: %s/n
                                                  • API String ID: 1543859921-1476993579
                                                  • Opcode ID: aa738c2a78bdc81aa820eca9ca993c19fc7cc6af9e6a9e3a721ceb691594f208
                                                  • Instruction ID: bb7bdc0f92cc2694eaa6ee34f7bcc843a23ee59e2d49304dadf9c875fa4d5d80
                                                  • Opcode Fuzzy Hash: aa738c2a78bdc81aa820eca9ca993c19fc7cc6af9e6a9e3a721ceb691594f208
                                                  • Instruction Fuzzy Hash: 04118671504301BBD360EB54DC46FEFB7E8AF88714F00492EF589D7290E67495588796
                                                  APIs
                                                    • Part of subcall function 00401190: EnterCriticalSection.KERNEL32(00497DC0,00000000,?,?,?,?,?,004014CD,?,?), ref: 00401199
                                                    • Part of subcall function 00401190: GdiplusStartup.GDIPLUS(00497DBC,?,?,?,?,?,?,?,004014CD,?,?), ref: 004011CD
                                                    • Part of subcall function 00401190: LeaveCriticalSection.KERNEL32(00497DC0,?,?,?,?,?,004014CD,?,?), ref: 004011DD
                                                  • GdipCreateBitmapFromFile.GDIPLUS ref: 004014FA
                                                  • GdipDisposeImage.GDIPLUS(?), ref: 0040152C
                                                  • GdipDisposeImage.GDIPLUS(00000000), ref: 00401559
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Gdip$CriticalDisposeImageSection$BitmapCreateEnterFileFromGdiplusLeaveStartup
                                                  • String ID: >=
                                                  • API String ID: 1500692541-3263226258
                                                  • Opcode ID: e9dd88c38cb5ca4bc35da1630157e35e7d1ec6af077491dd45c27da34a03c788
                                                  • Instruction ID: 2a3b4bfc414dc10881e7eec236f3a1e04021e9235cedc72d475739dca07e05aa
                                                  • Opcode Fuzzy Hash: e9dd88c38cb5ca4bc35da1630157e35e7d1ec6af077491dd45c27da34a03c788
                                                  • Instruction Fuzzy Hash: 2C01A5725043119BC710EF18D885AEFB7E8BFC4358F04892EF588AB260D738DA09C796
                                                  APIs
                                                  • GetSystemTimeAsFileTime.KERNEL32 ref: 0041C29B
                                                  • SHFormatDateTimeW.SHLWAPI(?,00000002,00000000), ref: 0041C2C8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Time$DateFileFormatSystem
                                                  • String ID: DiskDefrag\AutoDefragmention$LastDefragmention
                                                  • API String ID: 750415452-3598614746
                                                  • Opcode ID: e82a9422a2e71e94cea5bec6a8f095e47c1f013a3b59e1dfa3399cdb80a3d87a
                                                  • Instruction ID: a0b1e6286b276bc7d887fd98d5a7f5957222b11053583dbd66c01ec11ac0fb83
                                                  • Opcode Fuzzy Hash: e82a9422a2e71e94cea5bec6a8f095e47c1f013a3b59e1dfa3399cdb80a3d87a
                                                  • Instruction Fuzzy Hash: E4115276508701DFD300EF54DD85B9A7BE4FB48720F404A2EF156C22E1EB74A548CB56
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(?,00415169), ref: 004150B0
                                                  • LoadLibraryW.KERNEL32(?), ref: 004150C1
                                                  • GetProcAddress.KERNEL32(00000000,ImageList_Draw), ref: 004150DB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: AddressHandleLibraryLoadModuleProc
                                                  • String ID: ImageList_Draw
                                                  • API String ID: 310444273-2074868843
                                                  • Opcode ID: c2548a7b991ba7467d3f124a8d35b83a44c462a32142ecac1e07a96c10e5a41a
                                                  • Instruction ID: 64c332f81b35f2aaac3873e7666c404af8577304093a8f0924de00557a4645c6
                                                  • Opcode Fuzzy Hash: c2548a7b991ba7467d3f124a8d35b83a44c462a32142ecac1e07a96c10e5a41a
                                                  • Instruction Fuzzy Hash: 62F0D474601B01CFD7608FA9D988A43BBE4BB58715B50C82EE59AC3A00D778F480CF04
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(?,00415319,?,?,B7F9C0F2,?,?,00000000,B7F9C0F2,?,B7F9C0F2,?,00000000,00000000), ref: 00415253
                                                  • LoadLibraryW.KERNEL32(?), ref: 00415264
                                                  • GetProcAddress.KERNEL32(00000000,ImageList_GetImageInfo), ref: 0041527E
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: AddressHandleLibraryLoadModuleProc
                                                  • String ID: ImageList_GetImageInfo
                                                  • API String ID: 310444273-158344479
                                                  • Opcode ID: 631ada8aa74ce3b6fe86c1b860eda6107006effdbef0132884d037a0fc17c542
                                                  • Instruction ID: f55cdba9153e0e1c980a4fac1fe1aa85c7dcce68075fab81bff91a96374b76ea
                                                  • Opcode Fuzzy Hash: 631ada8aa74ce3b6fe86c1b860eda6107006effdbef0132884d037a0fc17c542
                                                  • Instruction Fuzzy Hash: 9EF0B275A00B41DFDB208FB8D848B82B7E4AB58715F00C82EA5AEC3611D738E480CF14
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(?,00415489,?,?,B7F9C0F2,?,?,00000000,004070E8,?,B7F9C0F2,?,00000000,00000000), ref: 004153D0
                                                  • LoadLibraryW.KERNEL32(?), ref: 004153E1
                                                  • GetProcAddress.KERNEL32(00000000,ImageList_GetImageCount), ref: 004153FB
                                                  Strings
                                                  • ImageList_GetImageCount, xrefs: 004153F5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: AddressHandleLibraryLoadModuleProc
                                                  • String ID: ImageList_GetImageCount
                                                  • API String ID: 310444273-4246500564
                                                  • Opcode ID: dc0ca7fa63d95de86685858bef82a952b7d7d020cd01d86cad7104e1fbda7d34
                                                  • Instruction ID: 982047e8d717f41167e3cd9be7dffe01ffe3abe97b222393831f80d9b05f459f
                                                  • Opcode Fuzzy Hash: dc0ca7fa63d95de86685858bef82a952b7d7d020cd01d86cad7104e1fbda7d34
                                                  • Instruction Fuzzy Hash: 08F07475601B45CFD7208F68D948A87B7E4FB58715B40892EE5AEC3A51D778E880CB08
                                                  APIs
                                                  • GetModuleHandleW.KERNEL32(?,00403E46,?,?,B7F9C0F2), ref: 00403DA0
                                                  • LoadLibraryW.KERNEL32(?), ref: 00403DB1
                                                  • GetProcAddress.KERNEL32(00000000,ImageList_AddMasked), ref: 00403DCB
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: AddressHandleLibraryLoadModuleProc
                                                  • String ID: ImageList_AddMasked
                                                  • API String ID: 310444273-822293376
                                                  • Opcode ID: 2cef274448d629194f45eaed383d3ce2d55fe80bf2e66e2031492a90ae4c9555
                                                  • Instruction ID: f86be7005d8cc87f643f266e3e9cbb46ccc5d3431ffdeeb8f838823e3b4bd8b2
                                                  • Opcode Fuzzy Hash: 2cef274448d629194f45eaed383d3ce2d55fe80bf2e66e2031492a90ae4c9555
                                                  • Instruction Fuzzy Hash: 06F06275611B019FDB209F68D948B06BBF8AF18B15B40883DA5AAD3A55D638E540CB04
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000040), ref: 00423E73
                                                  • SetPriorityClass.KERNEL32(00000000), ref: 00423E7A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ClassCurrentPriorityProcess
                                                  • String ID: DiskDefrag$Priority
                                                  • API String ID: 1822496659-2550450721
                                                  • Opcode ID: 4fd6964c920d56df250ae9ab2acb6b08c2f321825b7161079fb8931e388946b9
                                                  • Instruction ID: 65e6db7a757ac2f859af6c567d4dd87af2ab39161d08e9a40c4738524f0132bc
                                                  • Opcode Fuzzy Hash: 4fd6964c920d56df250ae9ab2acb6b08c2f321825b7161079fb8931e388946b9
                                                  • Instruction Fuzzy Hash: F3D05BB1580300BFE2006B90CC4EF553654EB00705F504419BB09950E2C6F55188C7AE
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000020), ref: 00423E33
                                                  • SetPriorityClass.KERNEL32(00000000), ref: 00423E3A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ClassCurrentPriorityProcess
                                                  • String ID: DiskDefrag$Priority
                                                  • API String ID: 1822496659-2550450721
                                                  • Opcode ID: 127201b981698b300859cc31292a0172134846cda05812359d7de4f29bee327f
                                                  • Instruction ID: 0765593b2bd4a548dc4285e73e255d63b39630105a75dc21cbbf118713a2a5a8
                                                  • Opcode Fuzzy Hash: 127201b981698b300859cc31292a0172134846cda05812359d7de4f29bee327f
                                                  • Instruction Fuzzy Hash: 1DD05B71580300BBE1006B90CC4EF553658EB00705F50441DBB09950E2C6F45188C76A
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000080), ref: 00423EB6
                                                  • SetPriorityClass.KERNEL32(00000000), ref: 00423EBD
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ClassCurrentPriorityProcess
                                                  • String ID: DiskDefrag$Priority
                                                  • API String ID: 1822496659-2550450721
                                                  • Opcode ID: 08ddfa592c1efdcbccc132c313bf1a44a42ddabc710bc291cfdf7ca59a51bf9a
                                                  • Instruction ID: cd9b91bb96566d5ac382291ffc385f6ffd504ff47ee525bf2600b2da5630117b
                                                  • Opcode Fuzzy Hash: 08ddfa592c1efdcbccc132c313bf1a44a42ddabc710bc291cfdf7ca59a51bf9a
                                                  • Instruction Fuzzy Hash: F8D05EB1680301BFE200ABD0CC4EF5A3668EB00B05F90881DFB09950E2CAF45188CBAA
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: AdjustPointer
                                                  • String ID:
                                                  • API String ID: 1740715915-0
                                                  • Opcode ID: 2f0b33c3719e7fcaed95029fb5341bdd68b0aeebc8bb7a8e810e980fd1942554
                                                  • Instruction ID: 8d54b60b4dbcadace8c8d92a661b26f00d94fd6d5e2cfe78c5a792aa377a4210
                                                  • Opcode Fuzzy Hash: 2f0b33c3719e7fcaed95029fb5341bdd68b0aeebc8bb7a8e810e980fd1942554
                                                  • Instruction Fuzzy Hash: 2451CFB6605203AFDB299F55D845BAEBFA4FF40310F24992DEA05872D1E731AC91CF90
                                                  APIs
                                                  • SendMessageW.USER32(?,0000130A,00000000,?), ref: 0042C87E
                                                  • GetClientRect.USER32(?,?), ref: 0042C88F
                                                  • SendMessageW.USER32(?,0000130A,00000000,?), ref: 0042C8C7
                                                  • GetClientRect.USER32(?,?), ref: 0042C8D2
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ClientMessageRectSend
                                                  • String ID:
                                                  • API String ID: 166717107-0
                                                  • Opcode ID: b63bd0a3e2817953073069a49dd37508e5c619b6a8f1caab7bdc8737ebf16daf
                                                  • Instruction ID: 1ae2c4f83a303b8bce0181d8b555b548ed397ea70dfa58a9d15d9eacc3878f9d
                                                  • Opcode Fuzzy Hash: b63bd0a3e2817953073069a49dd37508e5c619b6a8f1caab7bdc8737ebf16daf
                                                  • Instruction Fuzzy Hash: FC511AB1204301AFD714DE28CD85FABB7EAFBC4704F008A1DF99953694DBB0AD49CA65
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • GetParent.USER32(?), ref: 00410AB3
                                                  • GetParent.USER32(?), ref: 00410AC5
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105,00000000), ref: 00410AFA
                                                    • Part of subcall function 00414FD0: GetParent.USER32(?), ref: 00414FD4
                                                  • SendMessageW.USER32(?,0000108E,00000000,00000000), ref: 00410AE5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Parent$CriticalEnterMessageRedrawSectionSendWindow
                                                  • String ID:
                                                  • API String ID: 1290606431-0
                                                  • Opcode ID: 143fed41e4f3855d081119d730e229c73714f0bc93d99b8b5aa2bb9d49ef1950
                                                  • Instruction ID: 5206ba9288f2f952280e77a0a87cb2f91fe58ff6aeb235107940afbc2e9b071e
                                                  • Opcode Fuzzy Hash: 143fed41e4f3855d081119d730e229c73714f0bc93d99b8b5aa2bb9d49ef1950
                                                  • Instruction Fuzzy Hash: 5631B1723087049BD320DF64DC81F9BB3A4FB98720F10461EE9498B780DB79E841CB9A
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ClearVariant$AllocString
                                                  • String ID:
                                                  • API String ID: 2502263055-0
                                                  • Opcode ID: 4b2ef0f21c238e92dbe494a8f0535b867e123380ff90faf569da88cc72c8f9fe
                                                  • Instruction ID: d31ef5bb5228e6c3ad645c8f3d1319e11389829958ef149dbed2cab14c92e82a
                                                  • Opcode Fuzzy Hash: 4b2ef0f21c238e92dbe494a8f0535b867e123380ff90faf569da88cc72c8f9fe
                                                  • Instruction Fuzzy Hash: 15316F722087059FC310CF58C880B5BB7E8EF88718F104A2EF95997350DB79E909CB9A
                                                  APIs
                                                  • IsWindow.USER32(?), ref: 0041056D
                                                  • GetWindowRect.USER32(?,?), ref: 0041058D
                                                    • Part of subcall function 0041AA90: GetDC.USER32(?), ref: 0041AADC
                                                    • Part of subcall function 0041AA90: SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0041AAF4
                                                    • Part of subcall function 0041AA90: GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 0041AB1C
                                                    • Part of subcall function 0041AA90: ReleaseDC.USER32(?,?), ref: 0041AB37
                                                  • GetWindowRect.USER32(?,00000000), ref: 004105E2
                                                  • GetWindowRect.USER32(?,?), ref: 0041063B
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Window$Rect$ExtentMessagePoint32ReleaseSendText
                                                  • String ID:
                                                  • API String ID: 2970461787-0
                                                  • Opcode ID: 57304bb34f2a7c9d27d57c86e6bfdf64e083342261e5794d1aa935df15270c11
                                                  • Instruction ID: ce4c3b2ba86c6f6c119685c1f909f4ca062621dcfedb5de8325838dac45ff1a4
                                                  • Opcode Fuzzy Hash: 57304bb34f2a7c9d27d57c86e6bfdf64e083342261e5794d1aa935df15270c11
                                                  • Instruction Fuzzy Hash: E2314071244305AFD204DF61CCC5FABB3E9EBC8748F048A0CF58957290D674EA468B65
                                                  APIs
                                                  • GetDC.USER32(?), ref: 0040F162
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0040F17A
                                                  • GetClientRect.USER32(?,?), ref: 0040F19B
                                                  • ReleaseDC.USER32(?,?), ref: 0040F210
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ClientMessageRectReleaseSend
                                                  • String ID:
                                                  • API String ID: 1863454828-0
                                                  • Opcode ID: d11ef34d3e0fffcceb367614637f6adb86afbda3cb939e7e07ff16f8205efc76
                                                  • Instruction ID: d6bf508d08b3a67db9d2b0dabc6a54fdde4e7c081a099a00f88e8aa49dac70a3
                                                  • Opcode Fuzzy Hash: d11ef34d3e0fffcceb367614637f6adb86afbda3cb939e7e07ff16f8205efc76
                                                  • Instruction Fuzzy Hash: 7C3128B5204341AFC314DF68C984E5AB7E9FB88610F104A1EF559C3290EB34A905CB55
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: __aulldiv__aullrem
                                                  • String ID:
                                                  • API String ID: 3839614884-0
                                                  • Opcode ID: d3be8701daf285d51c64e253fdb0a8c1ca35a99fc3c88bc81763c7530e70c03f
                                                  • Instruction ID: 61ee5ff977679a68600c6b3ba5455a9d5faea7aa6e4a004e82da9cd24f1d17ea
                                                  • Opcode Fuzzy Hash: d3be8701daf285d51c64e253fdb0a8c1ca35a99fc3c88bc81763c7530e70c03f
                                                  • Instruction Fuzzy Hash: 8B21D2B6608351AFC310DE59D880E6BBBE8EBD9305F00495DF8849B302D275EC458BB6
                                                  APIs
                                                    • Part of subcall function 00419AE0: GetModuleHandleW.KERNEL32(ntdll,NtQuerySystemInformation), ref: 00419B01
                                                    • Part of subcall function 00419AE0: GetProcAddress.KERNEL32(00000000), ref: 00419B08
                                                  • Sleep.KERNEL32(0000000A), ref: 004248FF
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: AddressHandleModuleProcSleep
                                                  • String ID: CPUUsageExceed$DiskDefrag\AutoDefragmention$d
                                                  • API String ID: 451317006-1228882529
                                                  • Opcode ID: 927e2202433fb9e42a6fe3e98e5b36a04668a5a885c84e3f0056aeb2df8c8ff7
                                                  • Instruction ID: 2aae77fe05b5572fc9a22550ba8b2e73634bf3b6c40b7b563c05c91186231963
                                                  • Opcode Fuzzy Hash: 927e2202433fb9e42a6fe3e98e5b36a04668a5a885c84e3f0056aeb2df8c8ff7
                                                  • Instruction Fuzzy Hash: 6021D439B102224BD724DE68DD84BE73351DFC4325F5A4279ED098F382DB66EC468299
                                                  APIs
                                                  • DeviceIoControl.KERNEL32(00000000,00090073,?,00000008,00000000,00000800,?,00000000), ref: 00463572
                                                  • GetLastError.KERNEL32 ref: 00463581
                                                  • DeviceIoControl.KERNEL32(00000000,00090073,?,00000008,00000000,?,?,00000000), ref: 004635C1
                                                  • GetLastError.KERNEL32 ref: 004635C7
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ControlDeviceErrorLast
                                                  • String ID:
                                                  • API String ID: 2645620995-0
                                                  • Opcode ID: 280114bd6b1db9933460ef4d3ecd134f68ed06276e5ba2ce953f9defbee2e827
                                                  • Instruction ID: 72788d8031d8da8ebdf27af98cafe7d3eb32084a5d4fa9d01f0a72895e77951c
                                                  • Opcode Fuzzy Hash: 280114bd6b1db9933460ef4d3ecd134f68ed06276e5ba2ce953f9defbee2e827
                                                  • Instruction Fuzzy Hash: 8711C4716003412BE3109B169C46BAB769CEBD1710F44483EF548E6151EAA8EA098BEF
                                                  APIs
                                                  • GetDC.USER32(?), ref: 0041AADC
                                                  • SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0041AAF4
                                                  • GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 0041AB1C
                                                  • ReleaseDC.USER32(?,?), ref: 0041AB37
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: ExtentMessagePoint32ReleaseSendText
                                                  • String ID:
                                                  • API String ID: 3220701275-0
                                                  • Opcode ID: f4cd1229affaa01fb9d254a5843e7c69072dcfbfd1d68eba2fa87ff3b855b585
                                                  • Instruction ID: 1850dbf4910a2f6436d9a8060cce1c0b3c7b383cd418d825aeeea627d68539a0
                                                  • Opcode Fuzzy Hash: f4cd1229affaa01fb9d254a5843e7c69072dcfbfd1d68eba2fa87ff3b855b585
                                                  • Instruction Fuzzy Hash: 79213AB5604601AFC714DF68D985F6AB7E8FB8C710F008A2DF459C3690DB74E8448B95
                                                  APIs
                                                  • ___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00503B37
                                                  • ___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00503B50
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Value___vcrt_
                                                  • String ID:
                                                  • API String ID: 1426506684-0
                                                  • Opcode ID: 4bf36c79f714d2a89cb30e494d94226b7eda414baaf82c223360c7aa9f7a0c6f
                                                  • Instruction ID: 7353190b5c751d0058e391ed670595676dc79ce1cec29b7a24e191303f1d6a31
                                                  • Opcode Fuzzy Hash: 4bf36c79f714d2a89cb30e494d94226b7eda414baaf82c223360c7aa9f7a0c6f
                                                  • Instruction Fuzzy Hash: 3801DE321096225EE7203BA4BC8AA6F3F9CBB82378B20033AF024410E1EB514E516205
                                                  APIs
                                                  • __allrem.LIBCMT ref: 00454FE5
                                                  • __alldvrm.LIBCMT ref: 00454FF8
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045500B
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00455044
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__alldvrm__allrem
                                                  • String ID:
                                                  • API String ID: 2089711351-0
                                                  • Opcode ID: 9e2e06a4a2c618b65764ecf02f880869a055206a9d0490231dd6032392fa1694
                                                  • Instruction ID: 1642b9dd75f3a4511d1f743995959062418e168b9dabd897861ea646df64c966
                                                  • Opcode Fuzzy Hash: 9e2e06a4a2c618b65764ecf02f880869a055206a9d0490231dd6032392fa1694
                                                  • Instruction Fuzzy Hash: 44112AB5A00A00AFC324CF66C985D27BBE9EFC8714721C92EB59A87745D675FC40CB64
                                                  APIs
                                                  • LoadCursorW.USER32(00000000,?), ref: 0046D047
                                                  • LoadCursorW.USER32(00000000,00007F84), ref: 0046D059
                                                  • SetCursor.USER32(?,?,?,?,0046CB00,?,00000000,?,?), ref: 0046D06F
                                                  • DestroyCursor.USER32(00000000), ref: 0046D07A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Cursor$Load$Destroy
                                                  • String ID:
                                                  • API String ID: 2883253431-0
                                                  • Opcode ID: b526f51bf045ccedc4edf904a989a3b1655f38ad34df7115bdfe87dc4000c200
                                                  • Instruction ID: d6e58a44651a1d3402cb24b8e4ad2f5d6b0251b9aafb2ead04931a23fc49c706
                                                  • Opcode Fuzzy Hash: b526f51bf045ccedc4edf904a989a3b1655f38ad34df7115bdfe87dc4000c200
                                                  • Instruction Fuzzy Hash: 3E016771F142189FD730AF6AEC8096B37DCE756318F15083BE108D3211DA79A442877D
                                                  APIs
                                                  • SendMessageW.USER32(00000000,00000401,00000000,00000000), ref: 004676B7
                                                  • SendMessageW.USER32(00000000,00000403,00000003,000001F4), ref: 004676CC
                                                  • SendMessageW.USER32(00000000,00000403,00000002,00001770), ref: 004676E1
                                                  • SendMessageW.USER32(00000000,00000418,00000000,00000190), ref: 004676F6
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID:
                                                  • API String ID: 3850602802-0
                                                  • Opcode ID: 3e2714244d5c6f65102f12cb8e05017cbdfaef3b4b34307461ffb964c10c16d6
                                                  • Instruction ID: 05ecc198b00069830d56908e8e3e5e7e1269b8f0e776762def572f81c0fca120
                                                  • Opcode Fuzzy Hash: 3e2714244d5c6f65102f12cb8e05017cbdfaef3b4b34307461ffb964c10c16d6
                                                  • Instruction Fuzzy Hash: 0EF01D717C0B027AE2309A68DC82FA7A2A86B94B02F15582DF359FB1D196B875018E58
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: __aulldiv
                                                  • String ID: `=
                                                  • API String ID: 3732870572-2762138152
                                                  • Opcode ID: 89a6921c06f24090ffa03df58177ed7f9d03450d2280ec600551e15521660d28
                                                  • Instruction ID: d8bfd7cdfac141d9cfdb0ffece5a98f1ca78eb3dd6e2b02cd9253dc2d6ef05f2
                                                  • Opcode Fuzzy Hash: 89a6921c06f24090ffa03df58177ed7f9d03450d2280ec600551e15521660d28
                                                  • Instruction Fuzzy Hash: 6ED137756083409FC314DF69C98092BFBE4BFC8314F05896EF99997311E739E8058BA6
                                                  APIs
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045D3BE
                                                  • __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0045D3D1
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
                                                  • String ID: `=
                                                  • API String ID: 885266447-2762138152
                                                  • Opcode ID: fffd3d7282f3ca9193e1cd667b51c6e9b1393ee17bf43d276ed476b0d10faf7b
                                                  • Instruction ID: 5dffe6ef64173943b566a41739161ce8ce63ae2a9ff69b85a90aeb8992a9e3ab
                                                  • Opcode Fuzzy Hash: fffd3d7282f3ca9193e1cd667b51c6e9b1393ee17bf43d276ed476b0d10faf7b
                                                  • Instruction Fuzzy Hash: 24A17A71A043099FC324EF68C98096AB7F5FF89305F14892EE89687312D774F949CB5A
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: __aulldiv
                                                  • String ID: `=
                                                  • API String ID: 3732870572-2762138152
                                                  • Opcode ID: 3015ac86ba649a29268a85483f7edd6aab0f416968bd909a9fe1b0c52b9cb0c5
                                                  • Instruction ID: 84b8ef7fa6ef3b0704b7dcc146b1b846a3d4774a27478fb056f40241b994564c
                                                  • Opcode Fuzzy Hash: 3015ac86ba649a29268a85483f7edd6aab0f416968bd909a9fe1b0c52b9cb0c5
                                                  • Instruction Fuzzy Hash: 46719C71A046049FC724EF64C884A6BB7E4FF88311F14896EFC4687352D775E849CBAA
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • SHQueryRecycleBinW.SHELL32(?,?), ref: 0042B1A8
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CriticalEnterQueryRecycleSection
                                                  • String ID: C:\$`=
                                                  • API String ID: 1132591718-3292444104
                                                  • Opcode ID: b5a03216ac4e2065a6f4eb8bc31d67b0b14f5ff9ba7124aef4ada714505d985d
                                                  • Instruction ID: acc36582b151d86fb2590580dfdaf1570fbc9ca1bde0f0bfc179c8702fc33688
                                                  • Opcode Fuzzy Hash: b5a03216ac4e2065a6f4eb8bc31d67b0b14f5ff9ba7124aef4ada714505d985d
                                                  • Instruction Fuzzy Hash: 4F716D71604351CFC720EF64D981BAFB7E4FF88354F41892EE89997250D734A944CBAA
                                                  APIs
                                                  • GetCurrentProcess.KERNEL32(00000000), ref: 00456370
                                                  • GetCurrentProcess.KERNEL32(00000000,?), ref: 004563C5
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CurrentProcess
                                                  • String ID: P
                                                  • API String ID: 2050909247-3110715001
                                                  • Opcode ID: a03a8c6beb439d679fb0db97629ae7733890abcb9a7f1691b148e1a86304f56b
                                                  • Instruction ID: d9fc715740b337443135b9810308ba2b6a4282878f9a2242fee2fe4f623e65b9
                                                  • Opcode Fuzzy Hash: a03a8c6beb439d679fb0db97629ae7733890abcb9a7f1691b148e1a86304f56b
                                                  • Instruction Fuzzy Hash: 6951A0716006119BC710DF68D88466AB7A4FF89715F514B2FED2487392CB78EC48CBDA
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                    • Part of subcall function 004197C0: CoInitialize.OLE32(00000000), ref: 004197EE
                                                    • Part of subcall function 004197C0: CoCreateInstance.OLE32(0047D090,00000000,00000001,0047CFC0,?,?,?,00000000), ref: 00419812
                                                    • Part of subcall function 004197C0: CoUninitialize.OLE32(?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,00475709,000000FF,0041DB54), ref: 0041981C
                                                  • GetLogicalDrives.KERNEL32 ref: 00427273
                                                  • GetDriveTypeW.KERNEL32(?), ref: 004272D7
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CreateCriticalDriveDrivesEnterInitializeInstanceLogicalSectionTypeUninitialize
                                                  • String ID: C:\
                                                  • API String ID: 2354564324-3404278061
                                                  • Opcode ID: 4c4e95195703de95fd7ffe35624b2a04eb654934d4a600d942b4dae5c314729d
                                                  • Instruction ID: c90efa92af71126dba6429048660511b38e7c0dbb77debf846213f4ca3b284e1
                                                  • Opcode Fuzzy Hash: 4c4e95195703de95fd7ffe35624b2a04eb654934d4a600d942b4dae5c314729d
                                                  • Instruction Fuzzy Hash: 8A518971A187519FC314DF29D881A5BBBE4FF88714F804A2EF899C7390D734A904CB8A
                                                  APIs
                                                  • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00430FF8
                                                  Strings
                                                  • DefragFinishRingtone, xrefs: 0043102A
                                                  • DiskDefrag\Setting Option\Gereral, xrefs: 0043102F
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: DefragFinishRingtone$DiskDefrag\Setting Option\Gereral
                                                  • API String ID: 3850602802-1318132366
                                                  • Opcode ID: 611e42f2e74a1490c92c656b9c1f4233f09f845737786cc1f03fb69b9647b0cb
                                                  • Instruction ID: 0a2994e761213e214e5a4d6a869241ea1e3b325438042f93d97e0811baed8686
                                                  • Opcode Fuzzy Hash: 611e42f2e74a1490c92c656b9c1f4233f09f845737786cc1f03fb69b9647b0cb
                                                  • Instruction Fuzzy Hash: CE41717074820566EA30B7725D23BAF21489F1CB98F00562FFA19953C2FBEDD885859F
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Catch
                                                  • String ID: MOC$RCC
                                                  • API String ID: 78271584-2084237596
                                                  • Opcode ID: 60d334a2babda9015152320fb1b56685fe8a5b2565357ad46f9000524526b17b
                                                  • Instruction ID: 7f3e499a65fa1b5ee95370a69dc2f62e8b798b9dea4c67a4a9596effe2b86ecb
                                                  • Opcode Fuzzy Hash: 60d334a2babda9015152320fb1b56685fe8a5b2565357ad46f9000524526b17b
                                                  • Instruction Fuzzy Hash: 754159B1900209AFCF15DF98CD85AEEBFB5BF48304F1485A9FA04A6291D335AD60DF50
                                                  APIs
                                                    • Part of subcall function 00426DC0: EnterCriticalSection.KERNEL32(?,B7F9C0F2,?,?), ref: 00426E01
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00422CFC
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CriticalEnterRedrawSectionWindow
                                                  • String ID: DiskChecked$DiskDefrag
                                                  • API String ID: 142774367-2981518532
                                                  • Opcode ID: 0e7f0c6ffb299524d5b60ab7c9997cd566ac00e0446ecfe3a210d46a3707fafd
                                                  • Instruction ID: c399ede082bf33e8358967d7bf4ff09710be0966645c3ad0fdc692b3c116348a
                                                  • Opcode Fuzzy Hash: 0e7f0c6ffb299524d5b60ab7c9997cd566ac00e0446ecfe3a210d46a3707fafd
                                                  • Instruction Fuzzy Hash: EE21B1726003189BC728EE1DDD85BDAB7A0AF84700F90452DFE158F282DBB4AA04C798
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: ~P
                                                  • API String ID: 0-500931198
                                                  • Opcode ID: af959c50f9ceb22731f565f3fb959b59621721a55135329773564823bcb7b730
                                                  • Instruction ID: 3f53a812ee88c614be39cb66f25ae1a6b01f6845a1ee28e41b72ee3cff38c9b7
                                                  • Opcode Fuzzy Hash: af959c50f9ceb22731f565f3fb959b59621721a55135329773564823bcb7b730
                                                  • Instruction Fuzzy Hash: 62215E72A0820AAFDB10AF619C45A7E7FA9FF493647108525F915971D1D730FC5097A0
                                                  APIs
                                                  • GetVolumeNameForVolumeMountPointW.KERNEL32(?,00000000), ref: 0041DE53
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Volume$MountNamePoint
                                                  • String ID: C:\$DiskDefrag\SSD
                                                  • API String ID: 1269602640-2872339364
                                                  • Opcode ID: cc76f1b3ff457465d13abcf68c2bcec90b57b123ad2d10895c62ec857d4069d2
                                                  • Instruction ID: c621563c8422bd9a998db8b3ae63383a0df01fc5d31629062189869ad5b1e679
                                                  • Opcode Fuzzy Hash: cc76f1b3ff457465d13abcf68c2bcec90b57b123ad2d10895c62ec857d4069d2
                                                  • Instruction Fuzzy Hash: 16316AB1908701AFC314DF64DD85B5ABBE4FB88710F00492EF94A97290E735E948CB9A
                                                  APIs
                                                    • Part of subcall function 00432180: SendMessageW.USER32(0047D9D0,00001037,00000000,00000000), ref: 004322A8
                                                    • Part of subcall function 00432180: SendMessageW.USER32(?,00001036,00000000,00000000), ref: 004322BC
                                                  • SendMessageW.USER32(?,0000014E,?,00000000), ref: 00432160
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: DiskDefrag\Setting Option\Optimize$cbbFileSize
                                                  • API String ID: 3850602802-4101677200
                                                  • Opcode ID: 5d012cc000ad30419fbe295ad9283da05f428964ef3f062ec2218de17c19c3bd
                                                  • Instruction ID: c484c337b78f61a7d82ad98e4e7a9c8d2f838ff1f30f5547f561464bca46b6c3
                                                  • Opcode Fuzzy Hash: 5d012cc000ad30419fbe295ad9283da05f428964ef3f062ec2218de17c19c3bd
                                                  • Instruction Fuzzy Hash: 530121707D021A2BEA147E7A8D93FBE01498B85B08F00993E760BDE2C7CDDD8D484229
                                                  APIs
                                                  • GetVolumeNameForVolumeMountPointW.KERNEL32(?,00000000), ref: 0041DF73
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Volume$MountNamePoint
                                                  • String ID: C:\$DiskDefrag\SSD
                                                  • API String ID: 1269602640-2872339364
                                                  • Opcode ID: 7bf0067fdc715ad62ea400fca28faee1260d6c25cd8764403d7545c4f3a7dbe9
                                                  • Instruction ID: 5d073b895f258575d86a17cdac6f59c45116d1a3496c0b5e65ce3dbb7a15869e
                                                  • Opcode Fuzzy Hash: 7bf0067fdc715ad62ea400fca28faee1260d6c25cd8764403d7545c4f3a7dbe9
                                                  • Instruction Fuzzy Hash: 7B213CB5908301DFC304DF64D985B9ABBE4FF98710F004A2EF45A83290EB74D588CB96
                                                  APIs
                                                  • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 004025C2
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402044$CPUIdleTime
                                                  • API String ID: 3850602802-2665702501
                                                  • Opcode ID: 54736f6ff506063360bc645a57596676f049b47f42f9e55dd83d5a70f70a9f2e
                                                  • Instruction ID: 11bcaded1eea4243ffe6df52d9d88ed76b2ab53cb2a3c081b775842c2c83da62
                                                  • Opcode Fuzzy Hash: 54736f6ff506063360bc645a57596676f049b47f42f9e55dd83d5a70f70a9f2e
                                                  • Instruction Fuzzy Hash: 7D1182B1644601AFD314DF14DD85FAAB7A4FF48B20F10862EF55EA32D0DB78A844CB59
                                                  APIs
                                                  • SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00402692
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageSend
                                                  • String ID: 3402045$CPUUsageExceed
                                                  • API String ID: 3850602802-436957165
                                                  • Opcode ID: cd24271faf9151ddabbf47c82df0d4ed10ac9622f2cea84c7790e46732cfbc9f
                                                  • Instruction ID: ba179efc8f1fc514a3e2d6bea4a1845afbd83289b5d047454f20136ff34bde4d
                                                  • Opcode Fuzzy Hash: cd24271faf9151ddabbf47c82df0d4ed10ac9622f2cea84c7790e46732cfbc9f
                                                  • Instruction Fuzzy Hash: BB1191B1644601BFD310DF14DD85FAAB7A8FF48B14F108A2EF55EA22D0DB78A844CB59
                                                  APIs
                                                  • GetFileAttributesW.KERNEL32(?,B7F9C0F2,?,?,?,00478D19,000000FF,0045997D,?), ref: 0045CF8C
                                                  • CreateFileW.KERNEL32(?,00000080,00000007,00000000,00000003,20000000,00000000), ref: 0045CFE9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: File$AttributesCreate
                                                  • String ID: \\?\
                                                  • API String ID: 415043291-4282027825
                                                  • Opcode ID: f11458c9079e904aa5ae75219691bf0a44569f0ba620e8f6ec4a81eccf33a641
                                                  • Instruction ID: 901598558c3e4d11bc3258ba10a6420141faa6f62916cefdcf4a46bf13df9223
                                                  • Opcode Fuzzy Hash: f11458c9079e904aa5ae75219691bf0a44569f0ba620e8f6ec4a81eccf33a641
                                                  • Instruction Fuzzy Hash: EB1173766083009FE310CB54EC89F5BB7A9FB84721F10492EF959973D0D7789848C795
                                                  APIs
                                                  • GetLogicalDrives.KERNEL32 ref: 0041DB47
                                                    • Part of subcall function 004197C0: CoInitialize.OLE32(00000000), ref: 004197EE
                                                    • Part of subcall function 004197C0: CoCreateInstance.OLE32(0047D090,00000000,00000001,0047CFC0,?,?,?,00000000), ref: 00419812
                                                    • Part of subcall function 004197C0: CoUninitialize.OLE32(?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,00475709,000000FF,0041DB54), ref: 0041981C
                                                  • GetDriveTypeW.KERNEL32(?,?,?,75A7AF60), ref: 0041DB8A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CreateDriveDrivesInitializeInstanceLogicalTypeUninitialize
                                                  • String ID: C:\
                                                  • API String ID: 16435998-3404278061
                                                  • Opcode ID: e2f6a6bfb6f4e756cf92e2c82beab66c23b35661a5f3d38e2fb29b1420d17423
                                                  • Instruction ID: b0155039b9989220c3f10694d0f533bb6dad7ff0edda0b00871a7334ab537921
                                                  • Opcode Fuzzy Hash: e2f6a6bfb6f4e756cf92e2c82beab66c23b35661a5f3d38e2fb29b1420d17423
                                                  • Instruction Fuzzy Hash: 2901D4B6A183119B8314DF28DCC56AB73A5EB89314B01453FE45AC7251EB78AC84CBCA
                                                  APIs
                                                  • SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0042CF9B
                                                  • RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 0042CFF6
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: MessageRedrawSendWindow
                                                  • String ID: `=
                                                  • API String ID: 1030633669-2762138152
                                                  • Opcode ID: 322b72833a8646d25a97c7267da0ac355cbd00ada31bdbfef420a7c5b9529279
                                                  • Instruction ID: d25022c26ba7c65596874a3e6aca49c08802d942c9937e1375339a52bc2b998b
                                                  • Opcode Fuzzy Hash: 322b72833a8646d25a97c7267da0ac355cbd00ada31bdbfef420a7c5b9529279
                                                  • Instruction Fuzzy Hash: 46018B313006119BD7349A79DA89FDFB3A5AB94700F15481FF24ABB2C0CAF47881C64C
                                                  APIs
                                                  • RegOpenKeyW.ADVAPI32(80000002,SYSTEM\CurrentControlSet\services\BootDefrag), ref: 0041A7F7
                                                  • RegCloseKey.ADVAPI32 ref: 0041A811
                                                    • Part of subcall function 0041A820: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,?,?,00093E00,00000000,00476569,000000FF,0041A806), ref: 0041A883
                                                    • Part of subcall function 0041A820: PathFileExistsW.SHLWAPI(?,?,?,?,00093E00,00000000,00476569,000000FF,0041A806), ref: 0041A8F4
                                                    • Part of subcall function 0041A820: SHCreateDirectory.SHELL32(00000000,?,?,?,?,00093E00,00000000,00476569,000000FF,0041A806), ref: 0041A904
                                                  Strings
                                                  • SYSTEM\CurrentControlSet\services\BootDefrag, xrefs: 0041A7E5
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: Path$CloseCreateDirectoryExistsFileFolderOpenSpecial
                                                  • String ID: SYSTEM\CurrentControlSet\services\BootDefrag
                                                  • API String ID: 2992731242-3464295076
                                                  • Opcode ID: b9cba828d4abfd53c5caf4397c6bd50ab3a665ffc0be6c91e1721a714c795c9e
                                                  • Instruction ID: 6a09b35f9698f17151a02b8af7ff6770b374517e2ed940df591338b91f7cf978
                                                  • Opcode Fuzzy Hash: b9cba828d4abfd53c5caf4397c6bd50ab3a665ffc0be6c91e1721a714c795c9e
                                                  • Instruction Fuzzy Hash: 02D012B0215200DAE314BBB1DC45B9E33A4EB40315F10492EB45AC1580CB7894998B6A
                                                  APIs
                                                  • InterlockedExchange.KERNEL32(00497DDC,00000000), ref: 00401283
                                                  • CreateCompatibleDC.GDI32(00000000), ref: 00401295
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CompatibleCreateExchangeInterlocked
                                                  • String ID: }I
                                                  • API String ID: 1770991917-1906338323
                                                  • Opcode ID: 6375a689964595e525005095ae3faa2c41de4e6904f8434c51eb6425be86f1fa
                                                  • Instruction ID: a163272bfcbb607c39215aeccd5f887c100e22747e7019c329861ded96e1c357
                                                  • Opcode Fuzzy Hash: 6375a689964595e525005095ae3faa2c41de4e6904f8434c51eb6425be86f1fa
                                                  • Instruction Fuzzy Hash: 64D05E2390012056CA10521ABC48FE6672CAF91360F46427EF80DF71609329A8424AAC
                                                  APIs
                                                  • InterlockedExchange.KERNEL32(00497DDC,00000000), ref: 004012B2
                                                  • DeleteDC.GDI32(00000000), ref: 004012C4
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: DeleteExchangeInterlocked
                                                  • String ID: }I
                                                  • API String ID: 1722977832-1906338323
                                                  • Opcode ID: 3d9252111c2499e9892cd810a91747644d22c1b39faee1d2a360d963c6ead329
                                                  • Instruction ID: 0f44d1f4ef78c4913e9163893a1f1e1819881c729740a469ce0397d160b8c871
                                                  • Opcode Fuzzy Hash: 3d9252111c2499e9892cd810a91747644d22c1b39faee1d2a360d963c6ead329
                                                  • Instruction Fuzzy Hash: D1D05E678000205A9A04521ABC48CE7662CDE9536034A427EFC0DF3160D7299C428AAC
                                                  APIs
                                                  • CreateMutexW.KERNEL32(00000000,00000000,{E0A52416-D56A-4c3d-BFC7-3F40E77C718E}), ref: 0041A782
                                                  • GetLastError.KERNEL32 ref: 0041A793
                                                  Strings
                                                  • {E0A52416-D56A-4c3d-BFC7-3F40E77C718E}, xrefs: 0041A779
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorLastMutex
                                                  • String ID: {E0A52416-D56A-4c3d-BFC7-3F40E77C718E}
                                                  • API String ID: 1925916568-1835452401
                                                  • Opcode ID: 808971c6715f0aa7f10f9f42aa529678d4de9f456662d07aefcc006699d7f1bb
                                                  • Instruction ID: f658fb253292798967ff69ee4118aed0b3c4d26085bed42abcbed525fae359d1
                                                  • Opcode Fuzzy Hash: 808971c6715f0aa7f10f9f42aa529678d4de9f456662d07aefcc006699d7f1bb
                                                  • Instruction Fuzzy Hash: 80D05E383003019BEB609B30CC9979A35A0AB40742FE0887EF01FE46C0DA6CD5C48E09
                                                  APIs
                                                  • CreateMutexW.KERNEL32(00000000,00000000,{4391F12D-936B-4037-9383-DCB800DF7B65}), ref: 0041A742
                                                  • GetLastError.KERNEL32 ref: 0041A753
                                                  Strings
                                                  • {4391F12D-936B-4037-9383-DCB800DF7B65}, xrefs: 0041A739
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2369637578.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                  • Associated: 00000000.00000002.2369615770.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369699215.000000000047C000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369726780.0000000000496000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369749672.0000000000497000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369771119.0000000000499000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369811376.00000000004D6000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369860154.0000000000547000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369883554.000000000054A000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369904777.0000000000555000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369924268.0000000000558000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369944166.000000000055F000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369966520.0000000000563000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2369989992.000000000056B000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370007714.0000000000570000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370038053.000000000059D000.00000080.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2370054408.00000000005A0000.00000040.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_400000_37O0XUq6Vp.jbxd
                                                  Similarity
                                                  • API ID: CreateErrorLastMutex
                                                  • String ID: {4391F12D-936B-4037-9383-DCB800DF7B65}
                                                  • API String ID: 1925916568-3123431990
                                                  • Opcode ID: 091c4e7f644ce8bd6197cdb533c163e751dc47d35b49d56a391d01d6980858d1
                                                  • Instruction ID: ec8680d88669c7631082afe2fce56944a0d96bb555ced3f370f40cb7f6e8cb2a
                                                  • Opcode Fuzzy Hash: 091c4e7f644ce8bd6197cdb533c163e751dc47d35b49d56a391d01d6980858d1
                                                  • Instruction Fuzzy Hash: 32D05E343003019BEB646B30CC9539A35A0AB40742FE0887EF01FE46D0EA6CD5D49A09